w3wp.exe exception

Hi,

We are running ASP application in IIS 6.0.
But w3wp.exe crashes unexpectedly with the following message.

An exception dialog appears and one of the following message is logged
in event log


And any one of the following are logged in the System log during the
w3wp.exe exception:
Message 1

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Date: Date
Time: Time
User: N/A
Computer: ComputerName
Description:
A process serving application pool 'DefaultAppPool' terminated
unexpectedly. The process id was '1234'. The process exit code was
'0xc0000005'.


Message 2

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1011
Date: Date
Time: Time
User: N/A
Computer: ComputerName
Description:
A process serving application pool 'DefaultAppPool' suffered a fatal
communication error with the World Wide Web Publishing Service. The
process id was '1234'. The data field contains the error number.

Message 3

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1013
Date: Date
Time: Time
User: N/A
Computer: ComputerName
Description:
The process where application pool 'DefaultAppPool' was offered
exceeded the time limitation in the middle of the shutdown. Process id
was two '41 '


At times, only any of the above entry is found in the event log
without the w3wp.exe exception dialog.

We have run Microsoft's debug tool(Debug Diag) and have captured the
following


Analysis Summary
Type Description Recommendation
Error In
w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
access violation exception (0xC0000005) when trying to read from
memory location 0x00000002 on thread 8



Heap corruption was detected in heap 0x00080000, however pageheap was
not enabled in this dump. Please follow the instructions in the
recommendation section for troubleshooting heap corruption issues.



Current NTGlobalFlags value: 0x0 An access violation exception thrown
by a heap memory manager function indicates heap corruption. Please
follow the steps outlined in the following Knowledge Base article:

300966 Howto debug heap corruption issues in Internet Information
Services (IIS)
Warning 1 client connection(s) in
w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
have been executing a request for more than 90 seconds. Please see the
Client Connections section of this report for more detailed
information about the connection(s).





Analysis Details
Table Of Contents
w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp

Top 5 threads by CPU time

Thread report

COM+ STA ThreadPool Report

Well-Known COM STA Threads Report

HTTP Report

ASP Report

Faulting Module Information




Report for
w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
Type of Analysis Performed Combined Crash/Hang Analysis
Machine Name INFCH02041
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 2
Process ID 4468
Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
System Up-Time 4 day(s) 14:22:11
Process Up-Time 0 day(s) 00:19:47



Top 5 Threads by CPU time
Note - Times include both user mode and kernel mode for each thread
Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
Point for Thread: msvcrt!_endthreadex+2f
Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
Point for Thread: msvcrt!_endthreadex+2f
Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
Point for Thread: ntdll!RtlpWorkerThread
Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
Point for Thread: LeakTrack!UnloadThread
Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
Point for Thread: msvcrt!_endthreadex+2f





Thread report

Thread 0 - System ID 2232
Entry point w3wp!wmainCRTStartup
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.78
Time spent in kernel mode 0 Days 0:0:0.406




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3dt!WP_CONTEXT::RunMainThreadLoop+10
w3dt!UlAtqStartListen+2d
w3core!W3_SERVER::StartListen+bd
w3core!UlW3Start+26e
w3wp!wmain+22a
w3wp!wmainCRTStartup+12f
kernel32!BaseProcessStart+23




Back to Top


Thread 1 - System ID 4392
Entry point ntdll!RtlpTimerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.187
Time spent in kernel mode 0 Days 0:0:0.234




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
ntdll!RtlpTimerThread+47
kernel32!BaseThreadStart+34




Back to Top


Thread 2 - System ID 5596
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.312




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34




Back to Top


Thread 3 - System ID 5460
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34




Back to Top


Thread 4 - System ID 2164
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.62
Time spent in kernel mode 0 Days 0:0:0.218




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34




Back to Top


Thread 5 - System ID 3476
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.31
Time spent in kernel mode 0 Days 0:0:0.0




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34




Back to Top


Thread 6 - System ID 2768
Entry point ntdll!RtlpWaitThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.296




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
ntdll!RtlpWaitThread+161
kernel32!BaseThreadStart+34




Back to Top


Thread 7 - System ID 5800
Entry point w3core!HTTP_COMPRESSION::CompressionThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.281




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3core!HTTP_COMPRESSION::CompressionThread+126
kernel32!BaseThreadStart+34




Back to Top


Entry point rpcrt4!ThreadStartRoutine
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.296




Function Source
ntdll!ExpInterlockedPopEntrySListFault
ntdll!RtlpAllocateFromHeapLookaside+13
ntdll!RtlAllocateHeap+1dd
LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b
rpcrt4!AllocWrapper+1e
rpcrt4!operator new+d
rpcrt4!RPC_SERVER::CreateThread+7a
rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103
rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430
rpcrt4!RecvLotsaCallsWrapper+d
rpcrt4!BaseCachedThreadRoutine+9d
rpcrt4!ThreadStartRoutine+1b
kernel32!BaseThreadStart+34




Back to Top


Thread 9 - System ID 3284
Entry point ntdll!RtlpIOWorkerThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
ntdll!RtlpIOWorkerThread+3f
kernel32!BaseThreadStart+34




Back to Top


Thread 10 - System ID 5124
Entry point asp!CApplnCleanupMgr::ApplnCleanupThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.234




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
asp!CApplnCleanupMgr::ApplnCleanupDoWork+1e
asp!CApplnCleanupMgr::ApplnCleanupThread+a
kernel32!BaseThreadStart+34




Back to Top


Thread 11 - System ID 268
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
asp!CMTACallbackThread::Thread+4f
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 12 - System ID 4612
Entry point msvcrt!_endthread+3b
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.281




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
asp!Debugger+9e
msvcrt!_endthread+ab
kernel32!BaseThreadStart+34




Back to Top


Thread 13 - System ID 5964
Entry point pdm!DebuggerThreadEntry
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.46




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
pdm!CDebuggerThread::CallableWaitForMultiple+9d
pdm!CDebuggerThread::ThreadEntry+74
pdm!DebuggerThreadEntry+9
kernel32!BaseThreadStart+34




Back to Top


Thread 14 - System ID 5728
Entry point asp!CViperReqManager::WatchThread
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
asp!CViperReqManager::WatchThread+68
kernel32!BaseThreadStart+34




Back to Top


Thread 15 - System ID 5272
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.218




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
comsvcs!CSTAThreadPool::LoadBalanceThreadControlLoop+29
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 16 - System ID 4624
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
comsvcs!CSTAThreadPool::KillThreadControlLoop+25
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 17 - System ID 272
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.46
Time spent in kernel mode 0 Days 0:0:0.312




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
comsvcs!CSTAThread::WorkerLoop+1f9
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 18 - System ID 2976
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:2:57.859
Time spent in kernel mode 0 Days 0:8:38.93




This thread is not fully resolved and may or may not be a problem.
Further analysis of these threads may be required.



Function Source
ntdll!ExpInterlockedPopEntrySListFault
ntdll!RtlpAllocateFromHeapLookaside+13
ntdll!RtlAllocateHeap+1dd
LeakTrack!CHeapMemoryLT::HeapAllocDetour+71
ole32!CRetailMalloc_Alloc+16
LeakTrack!CCoTaskAllocatorLT::IMalloc_AllocDetour+64
oleaut32!APP_DATA::AllocCachedMem+4f
oleaut32!SysAllocStringByteLen+2e
LeakTrack!CBSTRLT::SysAllocStringByteLenDetour+68
oleaut32!ErrStringCopyNoNull+16
oleaut32!VariantChangeTypeEx+a8c
oleaut32!CoerceArg+3ff
oleaut32!CTypeInfo2::GetInvokeArgs+422
oleaut32!CTypeInfo2::Invoke+1d7
almcdbacc+6128
vbscript!IDispatchInvoke2+af
vbscript!IDispatchInvoke+59
vbscript!InvokeDispatch+13a
vbscript!InvokeByName+42
vbscript!CScriptRuntime::Run+2587
vbscript!CScriptEntryPoint::Call+5c
vbscript!CScriptRuntime::Run+20d4
vbscript!CScriptEntryPoint::Call+5c
vbscript!CScriptRuntime::Run+1f08
vbscript!CScriptEntryPoint::Call+5c
vbscript!CSession::Execute+b4
vbscript!COleScript::ExecutePendingScripts+13e
vbscript!COleScript::SetScriptState+150
asp!CActiveScriptEngine::TryCall+19
asp!CActiveScriptEngine::Call+31
asp!CallScriptFunctionOfEngine+5b
asp!ExecuteRequest+17e
asp!Execute+24c
asp!CHitObj::ViperAsyncCallback+3f0
asp!CViperAsyncRequest::OnCall+92
comsvcs!CSTAActivityWork::STAActivityWorkHelper+32
ole32!EnterForCallback+c4
ole32!SwitchForCallback+1a3
ole32!PerformCallback+54
ole32!CObjectContext::InternalContextCallback+159
ole32!CObjectContext::DoCallback+1c
comsvcs!CSTAActivityWork::DoWork+12d
comsvcs!CSTAThread::DoWork+18
comsvcs!CSTAThread::ProcessQueueWork+37
comsvcs!CSTAThread::WorkerLoop+190
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 19 - System ID 3112
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.562




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
comsvcs!CSTAThread::WorkerLoop+1f9
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 20 - System ID 3844
Entry point msvcrt!_endthreadex+2f
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:2.312
Time spent in kernel mode 0 Days 0:0:34.937




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
comsvcs!CSTAThread::WorkerLoop+1f9
msvcrt!_endthreadex+a3
kernel32!BaseThreadStart+34




Back to Top


Thread 21 - System ID 900
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 2007/09/11 10:11:06
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.250




Function Source
ntdll!KiFastSystemCallRet
user32!NtUserGetMessage+c
ole32!CDllHost::STAWorkerLoop+72
ole32!CDllHost::WorkerThread+c8
ole32!DLLHostThreadEntry+d
ole32!CRpcThread::WorkerLoop+26
ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
kernel32!BaseThreadStart+34




Back to Top


Thread 22 - System ID 6112
Entry point ntdll!RtlpWorkerThread
Create time 2007/09/11 10:13:06
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.218




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34




Back to Top


Thread 23 - System ID 4276
Entry point comsvcs!PingThread
Create time 2007/09/11 10:14:25
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.218




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
comsvcs!PingThread+f6
kernel32!BaseThreadStart+34




Back to Top


Thread 24 - System ID 1924
Entry point LeakTrack!CManager::WorkerThread
Create time 2007/09/11 10:14:40
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.468




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
LeakTrack!CManager::WorkerThread+6c
kernel32!BaseThreadStart+34




Back to Top


Thread 25 - System ID 2792
Entry point LeakTrack!CManager::WorkerThread
Create time 2007/09/11 10:14:40
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.31




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
LeakTrack!CManager::WorkerThread+6c
kernel32!BaseThreadStart+34




Back to Top


Thread 26 - System ID 3692
Entry point LeakTrack!UnloadThread
Create time 2007/09/11 10:14:40
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.718




Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
LeakTrack!UnloadThread+1e
kernel32!BaseThreadStart+34




Back to Top


Thread 27 - System ID 3404
Entry point ntdll!RtlpWorkerThread
Create time 2007/09/11 10:19:07
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.875




Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34




Back to Top

COM+ STA ThreadPool Report
Max STA Threads 50
Min STA Threads 4
Current STA Threads 4
g_activitiesPerThread 1
EmulateMTSBehavior False
STA Threads In-Call 0 (none)




Note: There was an error collecting details for the COM+ STA
Threadpool threads. The internal COM+ data structures may have been
corrupted.


Well-Known COM STA Threads Report
STA Name Thread ID Thread Status Call Status

Main STA 13 In-Call (bad symbols)
Apartment-threaded host for MTA clients 21 Idle (N/A)



HTTP report
IIS ATQ worker thread count 4 Thread(s)
Available ATQ worker thread count 4 Thread(s)
Active client connections 20 client connection(s)



Client Connections
Client connection from 127.0.0.1:3445 to 127.0.0.1:80
Host Header localhost:80
POST request for /jp1netmaudit/ALM_Retrieval.asp
HTTP Version HTTP/1.1
SSL Request False
Time alive 0 day(s) 00:16:27
QueryString
Request mapped to
HTTP Request State HTR_READING_CLIENT_REQUEST
Native Request State NREQ_STATE_PROCESS




19 connection(s) waiting for the next request.
ASP report
Executing ASP requests 0 Request(s)
ASP templates cached 8 Template(s)
ASP template cache size 1,589.66 KBytes
Loaded ASP applications 1 Application(s)
ASP.DLL Version 6.0.3790.4050



ASP application report
ASP application metabase key /LM/W3SVC/1/ROOT
Physical Path C:\INETPUB\WWWROOT\
Virtual Root /
Session Count 0 Session(s)
Request Count 0 Request(s)
Session Timeout 20 minutes(s)
Path to Global.asa
Server side script debugging enabled False
Client side script debugging enabled False
Out of process COM servers allowed False
Session state turned on True
Write buffering turned on True
Application restart enabled True
Parent paths enabled True
ASP Script error messages will be sent to browser True



ASP Template Cache report
ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_INDEX.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 78572 bytes
# of files in Template 2 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_INDEX.ASP 2007/08/29 14:14:04

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\GLOBAL.ASA
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 47152 bytes
# of files in Template 3 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\GLOBAL.ASA 2007/09/05 14:23:02

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_GLOBALASA.INC 2007/09/05 15:31:26

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_FILEDELETION.INC 2007/07/25 23:04:17



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_LOGIN.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 109828 bytes
# of files in Template 4 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_LOGIN.ASP 2007/08/22 10:25:33

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_LOGINLABEL.INC 2007/03/06 17:33:46

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_MESSAGE.INC 2007/09/06 17:59:30

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_AUTHENTICATION.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 126820 bytes
# of files in Template 5 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_AUTHENTICATION.ASP 2007/08/24 14:45:30

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_MESSAGE.INC 2007/09/06 17:59:30

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_LOGINDECODE.INC 2007/03/06 17:33:48

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_LOGINLABEL.INC 2007/03/06 17:33:46



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_TOPFRAME.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 102716 bytes
# of files in Template 4 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_TOPFRAME.ASP 2007/03/11 0:55:22

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_INDEX.INC 2007/08/07 11:51:55

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_MESSAGE.INC 2007/09/06 17:59:30



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_TREEVIEW.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 133296 bytes
# of files in Template 4 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_TREEVIEW.ASP 2007/09/04 11:51:40

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_INDEX.INC 2007/08/07 11:51:55

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_MESSAGE.INC 2007/09/06 17:59:30

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56



ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
\WWWROOT\ALM_RETRIEVAL.ASP
Application URL http://localhost:80/jp1netmaudit
Application Path /jp1netmaudit
Template Size 1028732 bytes
# of files in Template 9 file(s)
Include Heirarchy
F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
\ALM_RETRIEVAL.ASP 2007/09/04 17:18:44

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_RETRIEVALTOTALRETRIEVALLABEL.INC 2007/09/06 15:44:23

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_MESSAGE.INC 2007/09/06 17:59:30

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_CREATECSVPDF.INC 2007/03/11 0:55:22

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_CREATESEARCHCONDITION.INC 2007/06/08 16:50:21

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_COMMONFUNC.INC 2007/08/30 12:07:56

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_RETRIEVALFUNC.INC 2007/09/10 20:21:56

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_REPORTLABEL.INC 2007/08/30 18:54:21

F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
\ALMM_REPORTFUNC.INC 2007/09/06 18:26:24



ASP Template for C:\INETPUB\WWWROOT\1.ASP
Application URL http://localhost:80/
Application Path /
Template Size 694 bytes
# of files in Template 1 file(s)
Include Heirarchy
C:\INETPUB\WWWROOT\1.ASP 2007/09/10 19:29:42



NTDLL!EXPINTERLOCKEDPOPENTRYSLISTFAULT




Detailed Info For Corrupt Heap
Heap 1 - 0x00080000
Heap Name Default process heap
Heap Description This heap is created by default and shared by all
modules in the process
Reserved memory 512.06 MBytes
Committed memory 480.89 MBytes (93.91% of reserved)
Uncommitted memory 31.18 MBytes (6.09% of reserved)
Number of heap segments 10 segments
Number of uncommitted ranges 1 range(s)
Size of largest uncommitted range 31.12 MBytes
Calculated heap fragmentation 0.19%





Segment Information
Base Address Reserved Size Committed Size Uncommitted Size Number of
uncommitted ranges Largest uncommitted block Calculated heap
fragmentation
0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
0x050f0000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
0x05b30000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x05d30000 4.00 MBytes 4.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x06130000 8.00 MBytes 8.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x06930000 16.00 MBytes 16.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x07930000 32.00 MBytes 32.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x09930000 64.00 MBytes 64.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x10170000 128.00 MBytes 128.00 MBytes 0 Bytes 0 0 Bytes 0.00%
0x23410000 256.00 MBytes 224.88 MBytes 31.12 MBytes 1 31.12 MBytes
0.00%





Top 5 allocations by size

Allocation Size - 512
Allocation Size - 32
Allocation Size - 144
Allocation Size - 64
Allocation Size - 80





471.58 MBytes
602.75 KBytes
135.70 KBytes
101.69 KBytes
88.98 KBytes


Top 5 allocations by count

Allocation Size - 512
Allocation Size - 32
Allocation Size - 28
Allocation Size - 64
Allocation Size - 80





965794 allocation(s)
19288 allocation(s)
1948 allocation(s)
1627 allocation(s)
1139 allocation(s)

Back to Top







In
w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
access violation exception (0xC0000005) when trying to read from
memory location 0x00000002 on thread 8



Heap corruption was detected in heap 0x00080000, however pageheap was
not enabled in this dump. Please follow the instructions in the
recommendation section for troubleshooting heap corruption issues.



Current NTGlobalFlags value: 0x0 Module Information
Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB
Base address: 0x7c950000 Time Stamp: Sat Feb 17 21:22:26 2007
Checksum: 0x000dfa0d Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: NT Layer DLL
ISAPIFilter: False File Version: 5.2.3790.3959 (srv03_sp2_rtm.
070216-1710)
Managed DLL: False Internal Name: ntdll.dll
VB DLL: False Legal Copyright: c Microsoft Corporation. All rights
reserved.
Loaded Image Name: ntdll.dll Legal Trademarks:
Mapped Image Name: Original filename: ntdll.dll
Module name: ntdll Private Build:
Single Threaded: False Product Name: MicrosoftR WindowsR Operating
System
Module Size: 872.00 KBytes Product Version: 5.2.3790.3959
Symbol File Name: c:\symcache\ntdll.pdb
\93E72E109DC84F16AA54797E4DA8C1682\ntdll.pdb Special Build: &








Script Summary
Script Name Status Error Code Error Source Error Description Source
Line
IISAnalysis.asp Completed




We are not able to diagonise the problem.we will be happy ,if you can
able to help us.

Re: w3wp.exe exception

Do you have some custom ISAPI's?
http://support.microsoft.com/kb/892988

--

Best regards,

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield

http://www.IISLogs.com
Log archival solution.
Install, Configure, Forget

wrote in message
news:1189771346.662292.57480@50g2000hsm.googlegroups.com...
> Hi,
>
> We are running ASP application in IIS 6.0.
> But w3wp.exe crashes unexpectedly with the following message.
>
> An exception dialog appears and one of the following message is logged
> in event log
>
>
> And any one of the following are logged in the System log during the
> w3wp.exe exception:
> Message 1
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1009
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> A process serving application pool 'DefaultAppPool' terminated
> unexpectedly. The process id was '1234'. The process exit code was
> '0xc0000005'.
>
>
> Message 2
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1011
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> A process serving application pool 'DefaultAppPool' suffered a fatal
> communication error with the World Wide Web Publishing Service. The
> process id was '1234'. The data field contains the error number.
>
> Message 3
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1013
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> The process where application pool 'DefaultAppPool' was offered
> exceeded the time limitation in the middle of the shutdown. Process id
> was two '41 '
>
>
> At times, only any of the above entry is found in the event log
> without the w3wp.exe exception dialog.
>
> We have run Microsoft's debug tool(Debug Diag) and have captured the
> following
>
>
> Analysis Summary
> Type Description Recommendation
> Error In
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access violation exception (0xC0000005) when trying to read from
> memory location 0x00000002 on thread 8
>
>
>
> Heap corruption was detected in heap 0x00080000, however pageheap was
> not enabled in this dump. Please follow the instructions in the
> recommendation section for troubleshooting heap corruption issues.
>
>
>
> Current NTGlobalFlags value: 0x0 An access violation exception thrown
> by a heap memory manager function indicates heap corruption. Please
> follow the steps outlined in the following Knowledge Base article:
>
> 300966 Howto debug heap corruption issues in Internet Information
> Services (IIS)
> Warning 1 client connection(s) in
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
> have been executing a request for more than 90 seconds. Please see the
> Client Connections section of this report for more detailed
> information about the connection(s).
>
>
>
>
>
> Analysis Details
> Table Of Contents
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
>
> Top 5 threads by CPU time
>
> Thread report
>
> COM+ STA ThreadPool Report
>
> Well-Known COM STA Threads Report
>
> HTTP Report
>
> ASP Report
>
> Faulting Module Information
>
>
>
>
> Report for
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
> Type of Analysis Performed Combined Crash/Hang Analysis
> Machine Name INFCH02041
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 2
> Process ID 4468
> Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> System Up-Time 4 day(s) 14:22:11
> Process Up-Time 0 day(s) 00:19:47
>
>
>
> Top 5 Threads by CPU time
> Note - Times include both user mode and kernel mode for each thread
> Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> Point for Thread: msvcrt!_endthreadex+2f
> Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> Point for Thread: msvcrt!_endthreadex+2f
> Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> Point for Thread: ntdll!RtlpWorkerThread
> Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> Point for Thread: LeakTrack!UnloadThread
> Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> Point for Thread: msvcrt!_endthreadex+2f
>
>
>
>
>
> Thread report
>
> Thread 0 - System ID 2232
> Entry point w3wp!wmainCRTStartup
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.78
> Time spent in kernel mode 0 Days 0:0:0.406
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> w3dt!WP_CONTEXT::RunMainThreadLoop+10
> w3dt!UlAtqStartListen+2d
> w3core!W3_SERVER::StartListen+bd
> w3core!UlW3Start+26e
> w3wp!wmain+22a
> w3wp!wmainCRTStartup+12f
> kernel32!BaseProcessStart+23
>
>
>
>
> Back to Top
>
>
> Thread 1 - System ID 4392
> Entry point ntdll!RtlpTimerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.187
> Time spent in kernel mode 0 Days 0:0:0.234
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtDelayExecution+c
> ntdll!RtlpTimerThread+47
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 2 - System ID 5596
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.312
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 3 - System ID 5460
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 4 - System ID 2164
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.62
> Time spent in kernel mode 0 Days 0:0:0.218
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 5 - System ID 3476
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.31
> Time spent in kernel mode 0 Days 0:0:0.0
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 6 - System ID 2768
> Entry point ntdll!RtlpWaitThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.296
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> ntdll!RtlpWaitThread+161
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 7 - System ID 5800
> Entry point w3core!HTTP_COMPRESSION::CompressionThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.281
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> w3core!HTTP_COMPRESSION::CompressionThread+126
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Entry point rpcrt4!ThreadStartRoutine
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.296
>
>
>
>
> Function Source
> ntdll!ExpInterlockedPopEntrySListFault
> ntdll!RtlpAllocateFromHeapLookaside+13
> ntdll!RtlAllocateHeap+1dd
> LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b
> rpcrt4!AllocWrapper+1e
> rpcrt4!operator new+d
> rpcrt4!RPC_SERVER::CreateThread+7a
> rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103
> rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430
> rpcrt4!RecvLotsaCallsWrapper+d
> rpcrt4!BaseCachedThreadRoutine+9d
> rpcrt4!ThreadStartRoutine+1b
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 9 - System ID 3284
> Entry point ntdll!RtlpIOWorkerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtDelayExecution+c
> ntdll!RtlpIOWorkerThread+3f
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 10 - System ID 5124
> Entry point asp!CApplnCleanupMgr::ApplnCleanupThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.234
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> asp!CApplnCleanupMgr::ApplnCleanupDoWork+1e
> asp!CApplnCleanupMgr::ApplnCleanupThread+a
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 11 - System ID 268
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> asp!CMTACallbackThread::Thread+4f
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 12 - System ID 4612
> Entry point msvcrt!_endthread+3b
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.281
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> asp!Debugger+9e
> msvcrt!_endthread+ab
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 13 - System ID 5964
> Entry point pdm!DebuggerThreadEntry
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.46
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> pdm!CDebuggerThread::CallableWaitForMultiple+9d
> pdm!CDebuggerThread::ThreadEntry+74
> pdm!DebuggerThreadEntry+9
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 14 - System ID 5728
> Entry point asp!CViperReqManager::WatchThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> asp!CViperReqManager::WatchThread+68
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 15 - System ID 5272
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.218
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> comsvcs!CSTAThreadPool::LoadBalanceThreadControlLoop+29
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 16 - System ID 4624
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> comsvcs!CSTAThreadPool::KillThreadControlLoop+25
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 17 - System ID 272
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.46
> Time spent in kernel mode 0 Days 0:0:0.312
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> comsvcs!CSTAThread::WorkerLoop+1f9
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 18 - System ID 2976
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:2:57.859
> Time spent in kernel mode 0 Days 0:8:38.93
>
>
>
>
> This thread is not fully resolved and may or may not be a problem.
> Further analysis of these threads may be required.
>
>
>
> Function Source
> ntdll!ExpInterlockedPopEntrySListFault
> ntdll!RtlpAllocateFromHeapLookaside+13
> ntdll!RtlAllocateHeap+1dd
> LeakTrack!CHeapMemoryLT::HeapAllocDetour+71
> ole32!CRetailMalloc_Alloc+16
> LeakTrack!CCoTaskAllocatorLT::IMalloc_AllocDetour+64
> oleaut32!APP_DATA::AllocCachedMem+4f
> oleaut32!SysAllocStringByteLen+2e
> LeakTrack!CBSTRLT::SysAllocStringByteLenDetour+68
> oleaut32!ErrStringCopyNoNull+16
> oleaut32!VariantChangeTypeEx+a8c
> oleaut32!CoerceArg+3ff
> oleaut32!CTypeInfo2::GetInvokeArgs+422
> oleaut32!CTypeInfo2::Invoke+1d7
> almcdbacc+6128
> vbscript!IDispatchInvoke2+af
> vbscript!IDispatchInvoke+59
> vbscript!InvokeDispatch+13a
> vbscript!InvokeByName+42
> vbscript!CScriptRuntime::Run+2587
> vbscript!CScriptEntryPoint::Call+5c
> vbscript!CScriptRuntime::Run+20d4
> vbscript!CScriptEntryPoint::Call+5c
> vbscript!CScriptRuntime::Run+1f08
> vbscript!CScriptEntryPoint::Call+5c
> vbscript!CSession::Execute+b4
> vbscript!COleScript::ExecutePendingScripts+13e
> vbscript!COleScript::SetScriptState+150
> asp!CActiveScriptEngine::TryCall+19
> asp!CActiveScriptEngine::Call+31
> asp!CallScriptFunctionOfEngine+5b
> asp!ExecuteRequest+17e
> asp!Execute+24c
> asp!CHitObj::ViperAsyncCallback+3f0
> asp!CViperAsyncRequest::OnCall+92
> comsvcs!CSTAActivityWork::STAActivityWorkHelper+32
> ole32!EnterForCallback+c4
> ole32!SwitchForCallback+1a3
> ole32!PerformCallback+54
> ole32!CObjectContext::InternalContextCallback+159
> ole32!CObjectContext::DoCallback+1c
> comsvcs!CSTAActivityWork::DoWork+12d
> comsvcs!CSTAThread::DoWork+18
> comsvcs!CSTAThread::ProcessQueueWork+37
> comsvcs!CSTAThread::WorkerLoop+190
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 19 - System ID 3112
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.562
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> comsvcs!CSTAThread::WorkerLoop+1f9
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 20 - System ID 3844
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:2.312
> Time spent in kernel mode 0 Days 0:0:34.937
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> comsvcs!CSTAThread::WorkerLoop+1f9
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 21 - System ID 900
> Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.250
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> user32!NtUserGetMessage+c
> ole32!CDllHost::STAWorkerLoop+72
> ole32!CDllHost::WorkerThread+c8
> ole32!DLLHostThreadEntry+d
> ole32!CRpcThread::WorkerLoop+26
> ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 22 - System ID 6112
> Entry point ntdll!RtlpWorkerThread
> Create time 2007/09/11 10:13:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.218
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> ntdll!RtlpWorkerThread+3d
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 23 - System ID 4276
> Entry point comsvcs!PingThread
> Create time 2007/09/11 10:14:25
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.218
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> comsvcs!PingThread+f6
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 24 - System ID 1924
> Entry point LeakTrack!CManager::WorkerThread
> Create time 2007/09/11 10:14:40
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.468
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> LeakTrack!CManager::WorkerThread+6c
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 25 - System ID 2792
> Entry point LeakTrack!CManager::WorkerThread
> Create time 2007/09/11 10:14:40
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.31
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> LeakTrack!CManager::WorkerThread+6c
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 26 - System ID 3692
> Entry point LeakTrack!UnloadThread
> Create time 2007/09/11 10:14:40
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.718
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> LeakTrack!UnloadThread+1e
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
>
> Thread 27 - System ID 3404
> Entry point ntdll!RtlpWorkerThread
> Create time 2007/09/11 10:19:07
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.875
>
>
>
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> ntdll!RtlpWorkerThread+3d
> kernel32!BaseThreadStart+34
>
>
>
>
> Back to Top
>
> COM+ STA ThreadPool Report
> Max STA Threads 50
> Min STA Threads 4
> Current STA Threads 4
> g_activitiesPerThread 1
> EmulateMTSBehavior False
> STA Threads In-Call 0 (none)
>
>
>
>
> Note: There was an error collecting details for the COM+ STA
> Threadpool threads. The internal COM+ data structures may have been
> corrupted.
>
>
> Well-Known COM STA Threads Report
> STA Name Thread ID Thread Status Call Status
>
> Main STA 13 In-Call (bad symbols)
> Apartment-threaded host for MTA clients 21 Idle (N/A)
>
>
>
> HTTP report
> IIS ATQ worker thread count 4 Thread(s)
> Available ATQ worker thread count 4 Thread(s)
> Active client connections 20 client connection(s)
>
>
>
> Client Connections
> Client connection from 127.0.0.1:3445 to 127.0.0.1:80
> Host Header localhost:80
> POST request for /jp1netmaudit/ALM_Retrieval.asp
> HTTP Version HTTP/1.1
> SSL Request False
> Time alive 0 day(s) 00:16:27
> QueryString
> Request mapped to
> HTTP Request State HTR_READING_CLIENT_REQUEST
> Native Request State NREQ_STATE_PROCESS
>
>
>
>
> 19 connection(s) waiting for the next request.
> ASP report
> Executing ASP requests 0 Request(s)
> ASP templates cached 8 Template(s)
> ASP template cache size 1,589.66 KBytes
> Loaded ASP applications 1 Application(s)
> ASP.DLL Version 6.0.3790.4050
>
>
>
> ASP application report
> ASP application metabase key /LM/W3SVC/1/ROOT
> Physical Path C:\INETPUB\WWWROOT\
> Virtual Root /
> Session Count 0 Session(s)
> Request Count 0 Request(s)
> Session Timeout 20 minutes(s)
> Path to Global.asa
> Server side script debugging enabled False
> Client side script debugging enabled False
> Out of process COM servers allowed False
> Session state turned on True
> Write buffering turned on True
> Application restart enabled True
> Parent paths enabled True
> ASP Script error messages will be sent to browser True
>
>
>
> ASP Template Cache report
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_INDEX.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 78572 bytes
> # of files in Template 2 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_INDEX.ASP 2007/08/29 14:14:04
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\GLOBAL.ASA
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 47152 bytes
> # of files in Template 3 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \GLOBAL.ASA 2007/09/05 14:23:02
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_GLOBALASA.INC 2007/09/05 15:31:26
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_FILEDELETION.INC 2007/07/25 23:04:17
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_LOGIN.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 109828 bytes
> # of files in Template 4 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_LOGIN.ASP 2007/08/22 10:25:33
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_MESSAGE.INC 2007/09/06 17:59:30
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_AUTHENTICATION.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 126820 bytes
> # of files in Template 5 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_AUTHENTICATION.ASP 2007/08/24 14:45:30
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_MESSAGE.INC 2007/09/06 17:59:30
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_LOGINDECODE.INC 2007/03/06 17:33:48
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_LOGINLABEL.INC 2007/03/06 17:33:46
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_TOPFRAME.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 102716 bytes
> # of files in Template 4 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_TOPFRAME.ASP 2007/03/11 0:55:22
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_INDEX.INC 2007/08/07 11:51:55
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_MESSAGE.INC 2007/09/06 17:59:30
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_TREEVIEW.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 133296 bytes
> # of files in Template 4 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_TREEVIEW.ASP 2007/09/04 11:51:40
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_INDEX.INC 2007/08/07 11:51:55
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_MESSAGE.INC 2007/09/06 17:59:30
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
>
>
> ASP Template for F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER
> \WWWROOT\ALM_RETRIEVAL.ASP
> Application URL http://localhost:80/jp1netmaudit
> Application Path /jp1netmaudit
> Template Size 1028732 bytes
> # of files in Template 9 file(s)
> Include Heirarchy
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT
> \ALM_RETRIEVAL.ASP 2007/09/04 17:18:44
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_RETRIEVALTOTALRETRIEVALLABEL.INC 2007/09/06 15:44:23
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_MESSAGE.INC 2007/09/06 17:59:30
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_CREATECSVPDF.INC 2007/03/11 0:55:22
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_CREATESEARCHCONDITION.INC 2007/06/08 16:50:21
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_COMMONFUNC.INC 2007/08/30 12:07:56
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_RETRIEVALFUNC.INC 2007/09/10 20:21:56
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_REPORTLABEL.INC 2007/08/30 18:54:21
>
> F:\PROGRAM FILES\HITACHI\JP1NETMAUDIT\MANAGER\WWWROOT\INCLUDE
> \ALMM_REPORTFUNC.INC 2007/09/06 18:26:24
>
>
>
> ASP Template for C:\INETPUB\WWWROOT\1.ASP
> Application URL http://localhost:80/
> Application Path /
> Template Size 694 bytes
> # of files in Template 1 file(s)
> Include Heirarchy
> C:\INETPUB\WWWROOT\1.ASP 2007/09/10 19:29:42
>
>
>
> NTDLL!EXPINTERLOCKEDPOPENTRYSLISTFAULT
>
>
>
>
> Detailed Info For Corrupt Heap
> Heap 1 - 0x00080000
> Heap Name Default process heap
> Heap Description This heap is created by default and shared by all
> modules in the process
> Reserved memory 512.06 MBytes
> Committed memory 480.89 MBytes (93.91% of reserved)
> Uncommitted memory 31.18 MBytes (6.09% of reserved)
> Number of heap segments 10 segments
> Number of uncommitted ranges 1 range(s)
> Size of largest uncommitted range 31.12 MBytes
> Calculated heap fragmentation 0.19%
>
>
>
>
>
> Segment Information
> Base Address Reserved Size Committed Size Uncommitted Size Number of
> uncommitted ranges Largest uncommitted block Calculated heap
> fragmentation
> 0x00080640 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> 0x050f0000 1,024.00 KBytes 1,024.00 KBytes 0 Bytes 0 0 Bytes 0.00%
> 0x05b30000 2.00 MBytes 2.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x05d30000 4.00 MBytes 4.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x06130000 8.00 MBytes 8.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x06930000 16.00 MBytes 16.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x07930000 32.00 MBytes 32.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x09930000 64.00 MBytes 64.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x10170000 128.00 MBytes 128.00 MBytes 0 Bytes 0 0 Bytes 0.00%
> 0x23410000 256.00 MBytes 224.88 MBytes 31.12 MBytes 1 31.12 MBytes
> 0.00%
>
>
>
>
>
> Top 5 allocations by size
>
> Allocation Size - 512
> Allocation Size - 32
> Allocation Size - 144
> Allocation Size - 64
> Allocation Size - 80
>
>
>
>
>
> 471.58 MBytes
> 602.75 KBytes
> 135.70 KBytes
> 101.69 KBytes
> 88.98 KBytes
>
>
> Top 5 allocations by count
>
> Allocation Size - 512
> Allocation Size - 32
> Allocation Size - 28
> Allocation Size - 64
> Allocation Size - 80
>
>
>
>
>
> 965794 allocation(s)
> 19288 allocation(s)
> 1948 allocation(s)
> 1627 allocation(s)
> 1139 allocation(s)
>
> Back to Top
>
>
>
>
>
>
>
> In
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access violation exception (0xC0000005) when trying to read from
> memory location 0x00000002 on thread 8
>
>
>
> Heap corruption was detected in heap 0x00080000, however pageheap was
> not enabled in this dump. Please follow the instructions in the
> recommendation section for troubleshooting heap corruption issues.
>
>
>
> Current NTGlobalFlags value: 0x0 Module Information
> Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB
> Base address: 0x7c950000 Time Stamp: Sat Feb 17 21:22:26 2007
> Checksum: 0x000dfa0d Comments:
> COM DLL: False Company Name: Microsoft Corporation
> ISAPIExtension: False File Description: NT Layer DLL
> ISAPIFilter: False File Version: 5.2.3790.3959 (srv03_sp2_rtm.
> 070216-1710)
> Managed DLL: False Internal Name: ntdll.dll
> VB DLL: False Legal Copyright: c Microsoft Corporation. All rights
> reserved.
> Loaded Image Name: ntdll.dll Legal Trademarks:
> Mapped Image Name: Original filename: ntdll.dll
> Module name: ntdll Private Build:
> Single Threaded: False Product Name: MicrosoftR WindowsR Operating
> System
> Module Size: 872.00 KBytes Product Version: 5.2.3790.3959
> Symbol File Name: c:\symcache\ntdll.pdb
> \93E72E109DC84F16AA54797E4DA8C1682\ntdll.pdb Special Build: &
>
>
>
>
>
>
>
>
> Script Summary
> Script Name Status Error Code Error Source Error Description Source
> Line
> IISAnalysis.asp Completed
>
>
>
>
> We are not able to diagonise the problem.we will be happy ,if you can
> able to help us.
>

Re: w3wp.exe exception

Your application is running native code which is crashing the worker
process (that's what 0xc0000005 means).

There is also signs of memory corruption in the worker process. It
*may* be the cause of the crash (in which case you have one issue), or
it may not (which means you have more than one issue within your
website).

Please start by identifying all custom ISAPI Filter DLL and ISAPI
Extension DLL loaded on your server.

When there is signs of memory corruption, the code that actually
crashed may *not* be the culprit but rather unfortunate victim of the
memory corrupting code. For example, the code that crashed in your
example was NTDLL, an internal Windows DLL, but what it was doing is
hardly the cause of the memory corruption -- it is clearly the victim
of some other memory corrupting code. It is usually beneficial to
enable PageHeap to catch many (but not all) code that corrupt memory
as it corrupts its, which is like catching a crook red-handed.

Microsoft publishes free Application Verifier as well as Debugging
Tools which do all these things (and more), as well as general
instructions on how to use them. It would be beneficial in your
situation to use them to diagnose your issue.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//




On Sep 14, 5:02 am, GaneshBabu...@gmail.com wrote:
> Hi,
>
> We are running ASP application in IIS 6.0.
> But w3wp.exe crashes unexpectedly with the following message.
>
> An exception dialog appears and one of the following message is logged
> in event log
>
> And any one of the following are logged in the System log during the
> w3wp.exe exception:
> Message 1
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1009
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> A process serving application pool 'DefaultAppPool' terminated
> unexpectedly. The process id was '1234'. The process exit code was
> '0xc0000005'.
>
> Message 2
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1011
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> A process serving application pool 'DefaultAppPool' suffered a fatal
> communication error with the World Wide Web Publishing Service. The
> process id was '1234'. The data field contains the error number.
>
> Message 3
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1013
> Date: Date
> Time: Time
> User: N/A
> Computer: ComputerName
> Description:
> The process where application pool 'DefaultAppPool' was offered
> exceeded the time limitation in the middle of the shutdown. Process id
> was two '41 '
>
> At times, only any of the above entry is found in the event log
> without the w3wp.exe exception dialog.
>
> We have run Microsoft's debug tool(Debug Diag) and have captured the
> following
>
> Analysis Summary
> Type Description Recommendation
> Error In
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exce=
pt=ADion_C0000005.dmp
> the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access violation exception (0xC0000005) when trying to read from
> memory location 0x00000002 on thread 8
>
> Heap corruption was detected in heap 0x00080000, however pageheap was
> not enabled in this dump. Please follow the instructions in the
> recommendation section for troubleshooting heap corruption issues.
>
> Current NTGlobalFlags value: 0x0 An access violation exception thrown
> by a heap memory manager function indicates heap corruption. Please
> follow the steps outlined in the following Knowledge Base article:
>
> 300966 Howto debug heap corruption issues in Internet Information
> Services (IIS)
> Warning 1 client connection(s) in
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exce=
pt=ADion_C0000005.dmp
> have been executing a request for more than 90 seconds. Please see the
> Client Connections section of this report for more detailed
> information about the connection(s).
>
> Analysis Details
> Table Of Contents
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exce=
pt=ADion_C0000005.dmp
>
> Top 5 threads by CPU time
>
> Thread report
>
> COM+ STA ThreadPool Report
>
> Well-Known COM STA Threads Report
>
> HTTP Report
>
> ASP Report
>
> Faulting Module Information
>
> Report for
> w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Exce=
pt=ADion_C0000005.dmp
> Type of Analysis Performed Combined Crash/Hang Analysis
> Machine Name INFCH02041
> Operating System Windows Server 2003 Service Pack 2
> Number Of Processors 2
> Process ID 4468
> Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> System Up-Time 4 day(s) 14:22:11
> Process Up-Time 0 day(s) 00:19:47
>
> Top 5 Threads by CPU time
> Note - Times include both user mode and kernel mode for each thread
> Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> Point for Thread: msvcrt!_endthreadex+2f
> Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> Point for Thread: msvcrt!_endthreadex+2f
> Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> Point for Thread: ntdll!RtlpWorkerThread
> Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> Point for Thread: LeakTrack!UnloadThread
> Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> Point for Thread: msvcrt!_endthreadex+2f
>
> Thread report
>
> Thread 0 - System ID 2232
> Entry point w3wp!wmainCRTStartup
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.78
> Time spent in kernel mode 0 Days 0:0:0.406
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> w3dt!WP_CONTEXT::RunMainThreadLoop+10
> w3dt!UlAtqStartListen+2d
> w3core!W3_SERVER::StartListen+bd
> w3core!UlW3Start+26e
> w3wp!wmain+22a
> w3wp!wmainCRTStartup+12f
> kernel32!BaseProcessStart+23
>
> Back to Top
>
> Thread 1 - System ID 4392
> Entry point ntdll!RtlpTimerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.187
> Time spent in kernel mode 0 Days 0:0:0.234
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtDelayExecution+c
> ntdll!RtlpTimerThread+47
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 2 - System ID 5596
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.312
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 3 - System ID 5460
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 4 - System ID 2164
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.62
> Time spent in kernel mode 0 Days 0:0:0.218
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 5 - System ID 3476
> Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.31
> Time spent in kernel mode 0 Days 0:0:0.0
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!ZwRemoveIoCompletion+c
> kernel32!GetQueuedCompletionStatus+29
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> w3tp!THREAD_MANAGER::ThreadManagerThread+39
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 6 - System ID 2768
> Entry point ntdll!RtlpWaitThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.296
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> ntdll!RtlpWaitThread+161
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 7 - System ID 5800
> Entry point w3core!HTTP_COMPRESSION::CompressionThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.281
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> w3core!HTTP_COMPRESSION::CompressionThread+126
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Entry point rpcrt4!ThreadStartRoutine
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.15
> Time spent in kernel mode 0 Days 0:0:0.296
>
> Function Source
> ntdll!ExpInterlockedPopEntrySListFault
> ntdll!RtlpAllocateFromHeapLookaside+13
> ntdll!RtlAllocateHeap+1dd
> LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b
> rpcrt4!AllocWrapper+1e
> rpcrt4!operator new+d
> rpcrt4!RPC_SERVER::CreateThread+7a
> rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103
> rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430
> rpcrt4!RecvLotsaCallsWrapper+d
> rpcrt4!BaseCachedThreadRoutine+9d
> rpcrt4!ThreadStartRoutine+1b
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 9 - System ID 3284
> Entry point ntdll!RtlpIOWorkerThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtDelayExecution+c
> ntdll!RtlpIOWorkerThread+3f
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 10 - System ID 5124
> Entry point asp!CApplnCleanupMgr::ApplnCleanupThread
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.234
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForSingleObject+c
> kernel32!WaitForSingleObjectEx+ac
> kernel32!WaitForSingleObject+12
> asp!CApplnCleanupMgr::ApplnCleanupDoWork+1e
> asp!CApplnCleanupMgr::ApplnCleanupThread+a
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 11 - System ID 268
> Entry point msvcrt!_endthreadex+2f
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.15
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> asp!CMTACallbackThread::Thread+4f
> msvcrt!_endthreadex+a3
> kernel32!BaseThreadStart+34
>
> Back to Top
>
> Thread 12 - System ID 4612
> Entry point msvcrt!_endthread+3b
> Create time 2007/09/11 10:11:06
> Time spent in user mode 0 Days 0:0:0.0
> Time spent in kernel mode 0 Days 0:0:0.281
>
> Function Source
> ntdll!KiFastSystemCallRet
> ntdll!NtWaitForMultipleObjects+c
> kernel32!WaitForMultipleObjectsEx+11a
> user32!RealMsgWaitForMultipleObjectsEx+141
> user32!MsgWaitForMultipleObjects+1f
> asp!Debugger+9e
> msvcrt!_endthread+ab
> kernel32!BaseThreadStart+34
>
> Back to Top
> ...
>
> read more =BB

Re: w3wp.exe exception

Thanks for the help. But we dont use any ISAPI DLLs in our
application. We reviewed the code for memory leaks but didnt find any
problem. This problem is occurring only in windows 2003 R2 SP2. Will
it be a problem with 2003 R2?


On Sep 16, 12:14 pm, David Wang wrote:
> Your application is running native code which is crashing the worker
> process (that's what 0xc0000005 means).
>
> There is also signs of memory corruption in the worker process. It
> *may* be the cause of the crash (in which case you have one issue), or
> it may not (which means you have more than one issue within your
> website).
>
> Please start by identifying all custom ISAPI Filter DLL and ISAPI
> Extension DLL loaded on your server.
>
> When there is signs of memory corruption, the code that actually
> crashed may *not* be the culprit but rather unfortunate victim of the
> memory corrupting code. For example, the code that crashed in your
> example was NTDLL, an internal Windows DLL, but what it was doing is
> hardly the cause of the memory corruption -- it is clearly the victim
> of some other memory corrupting code. It is usually beneficial to
> enable PageHeap to catch many (but not all) code that corrupt memory
> as it corrupts its, which is like catching a crook red-handed.
>
> Microsoft publishes free Application Verifier as well as Debugging
> Tools which do all these things (and more), as well as general
> instructions on how to use them. It would be beneficial in your
> situation to use them to diagnose your issue.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Sep 14, 5:02 am, GaneshBabu...@gmail.com wrote:
>
>
>
> > Hi,
>
> > We are running ASP application in IIS 6.0.
> > But w3wp.exe crashes unexpectedly with the following message.
>
> > An exception dialog appears and one of the following message is logged
> > in event log
>
> > And any one of the following are logged in the System log during the
> > w3wp.exe exception:
> > Message 1
>
> > Event Type: Warning
> > Event Source: W3SVC
> > Event Category: None
> > Event ID: 1009
> > Date: Date
> > Time: Time
> > User: N/A
> > Computer: ComputerName
> > Description:
> > A process serving application pool 'DefaultAppPool' terminated
> > unexpectedly. The process id was '1234'. The process exit code was
> > '0xc0000005'.
>
> > Message 2
>
> > Event Type: Warning
> > Event Source: W3SVC
> > Event Category: None
> > Event ID: 1011
> > Date: Date
> > Time: Time
> > User: N/A
> > Computer: ComputerName
> > Description:
> > A process serving application pool 'DefaultAppPool' suffered a fatal
> > communication error with the World Wide Web Publishing Service. The
> > process id was '1234'. The data field contains the error number.
>
> > Message 3
>
> > Event Type: Warning
> > Event Source: W3SVC
> > Event Category: None
> > Event ID: 1013
> > Date: Date
> > Time: Time
> > User: N/A
> > Computer: ComputerName
> > Description:
> > The process where application pool 'DefaultAppPool' was offered
> > exceeded the time limitation in the middle of the shutdown. Process id
> > was two '41 '
>
> > At times, only any of the above entry is found in the event log
> > without the w3wp.exe exception dialog.
>
> > We have run Microsoft's debug tool(Debug Diag) and have captured the
> > following
>
> > Analysis Summary
> > Type Description Recommendation
> > Error In
> > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Ex=
cept­­ion_C0000005.dmp
> > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > access violation exception (0xC0000005) when trying to read from
> > memory location 0x00000002 on thread 8
>
> > Heap corruption was detected in heap 0x00080000, however pageheap was
> > not enabled in this dump. Please follow the instructions in the
> > recommendation section for troubleshooting heap corruption issues.
>
> > Current NTGlobalFlags value: 0x0 An access violation exception thrown
> > by a heap memory manager function indicates heap corruption. Please
> > follow the steps outlined in the following Knowledge Base article:
>
> > 300966 Howto debug heap corruption issues in Internet Information
> > Services (IIS)
> > Warning 1 client connection(s) in
> > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Ex=
cept­­ion_C0000005.dmp
> > have been executing a request for more than 90 seconds. Please see the
> > Client Connections section of this report for more detailed
> > information about the connection(s).
>
> > Analysis Details
> > Table Of Contents
> > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Ex=
cept­­ion_C0000005.dmp
>
> > Top 5 threads by CPU time
>
> > Thread report
>
> > COM+ STA ThreadPool Report
>
> > Well-Known COM STA Threads Report
>
> > HTTP Report
>
> > ASP Report
>
> > Faulting Module Information
>
> > Report for
> > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_Ex=
cept­­ion_C0000005.dmp
> > Type of Analysis Performed Combined Crash/Hang Analysis
> > Machine Name INFCH02041
> > Operating System Windows Server 2003 Service Pack 2
> > Number Of Processors 2
> > Process ID 4468
> > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> > System Up-Time 4 day(s) 14:22:11
> > Process Up-Time 0 day(s) 00:19:47
>
> > Top 5 Threads by CPU time
> > Note - Times include both user mode and kernel mode for each thread
> > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> > Point for Thread: msvcrt!_endthreadex+2f
> > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> > Point for Thread: msvcrt!_endthreadex+2f
> > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> > Point for Thread: ntdll!RtlpWorkerThread
> > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> > Point for Thread: LeakTrack!UnloadThread
> > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> > Point for Thread: msvcrt!_endthreadex+2f
>
> > Thread report
>
> > Thread 0 - System ID 2232
> > Entry point w3wp!wmainCRTStartup
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.78
> > Time spent in kernel mode 0 Days 0:0:0.406
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!NtWaitForSingleObject+c
> > kernel32!WaitForSingleObjectEx+ac
> > kernel32!WaitForSingleObject+12
> > w3dt!WP_CONTEXT::RunMainThreadLoop+10
> > w3dt!UlAtqStartListen+2d
> > w3core!W3_SERVER::StartListen+bd
> > w3core!UlW3Start+26e
> > w3wp!wmain+22a
> > w3wp!wmainCRTStartup+12f
> > kernel32!BaseProcessStart+23
>
> > Back to Top
>
> > Thread 1 - System ID 4392
> > Entry point ntdll!RtlpTimerThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.187
> > Time spent in kernel mode 0 Days 0:0:0.234
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!NtDelayExecution+c
> > ntdll!RtlpTimerThread+47
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 2 - System ID 5596
> > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.15
> > Time spent in kernel mode 0 Days 0:0:0.312
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!ZwRemoveIoCompletion+c
> > kernel32!GetQueuedCompletionStatus+29
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 3 - System ID 5460
> > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.15
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!ZwRemoveIoCompletion+c
> > kernel32!GetQueuedCompletionStatus+29
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 4 - System ID 2164
> > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.62
> > Time spent in kernel mode 0 Days 0:0:0.218
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!ZwRemoveIoCompletion+c
> > kernel32!GetQueuedCompletionStatus+29
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 5 - System ID 3476
> > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.31
> > Time spent in kernel mode 0 Days 0:0:0.0
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!ZwRemoveIoCompletion+c
> > kernel32!GetQueuedCompletionStatus+29
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 6 - System ID 2768
> > Entry point ntdll!RtlpWaitThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.296
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!NtWaitForMultipleObjects+c
> > ntdll!RtlpWaitThread+161
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Thread 7 - System ID 5800
> > Entry point w3core!HTTP_COMPRESSION::CompressionThread
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.0
> > Time spent in kernel mode 0 Days 0:0:0.281
>
> > Function Source
> > ntdll!KiFastSystemCallRet
> > ntdll!NtWaitForSingleObject+c
> > kernel32!WaitForSingleObjectEx+ac
> > kernel32!WaitForSingleObject+12
> > w3core!HTTP_COMPRESSION::CompressionThread+126
> > kernel32!BaseThreadStart+34
>
> > Back to Top
>
> > Entry point rpcrt4!ThreadStartRoutine
> > Create time 2007/09/11 10:11:06
> > Time spent in user mode 0 Days 0:0:0.15
> > Time spent in kernel mode 0 Days 0:0:0.296
>
> > Function Source
> > ntdll!ExpInterlockedPopEntrySListFault
> > ntdll!RtlpAllocateFromHeapLookaside+13
> > ntdll!RtlAllocateHeap+1dd
> > LeakTrack!CHeapMemoryLT::HeapAllocDetour+3b
> > rpcrt4!AllocWrapper+1e
> > rpcrt4!operator new+d
> > rpcrt4!RPC_SERVER::CreateThread+7a
> > rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+103
> > rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+430
> > rpcrt4!RecvLotsaCallsWrapper+d
> > rpcrt4!BaseCachedThreadRoutine+9d
> > rpcrt4!ThreadStartRoutine+1b
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

It *could*, but I consider it the last option to explore because if it
is a problem with IIS/Windows, the issue would be hit far more
frequently and honestly we haven't seen such a deluge. I realize that
users usually trust their own code and not Microsoft's, but history
has shown that to be an incorrect assumption. Put in another way -- if
your application gets used by 100 million people in countless
different ways, how likely do you think it'd have issues?

ISAPI DLL is a common cause but not the only. Are you running *any*
third party code with your application. I see that your application is
ASP, so it is purely ASP which does not do *any* Server.CreateObject()
or new ActiveXObject() calls? Those calls would load other native
code into the web server that could crash, even if your web page is
pure ASP.

I'm also going to have to check if that "crash" is one of the expected
exceptions -- there's a couple of internal Windows APIs that actually
use exceptions as a normal part of operation and should be ignored by
the debugger. I could have sworn ntdll!
ExpInterlockedPopEntrySListFault is one of them.

Does this happen if you do not run DebugDiag to track memory leaks?
Because you have a crash, not memory leak, and they are tracked
differently


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//




On Sep 16, 9:52 pm, GaneshBabu...@gmail.com wrote:
> Thanks for the help. But we dont use any ISAPI DLLs in our
> application. We reviewed the code for memory leaks but didnt find any
> problem. This problem is occurring only in windows 2003 R2 SP2. Will
> it be a problem with 2003 R2?
>
> On Sep 16, 12:14 pm, David Wang wrote:
>
>
>
> > Your application is running native code which is crashing the worker
> > process (that's what 0xc0000005 means).
>
> > There is also signs of memory corruption in the worker process. It
> > *may* be the cause of the crash (in which case you have one issue), or
> > it may not (which means you have more than one issue within your
> > website).
>
> > Please start by identifying all custom ISAPI Filter DLL and ISAPI
> > Extension DLL loaded on your server.
>
> > When there is signs of memory corruption, the code that actually
> > crashed may *not* be the culprit but rather unfortunate victim of the
> > memory corrupting code. For example, the code that crashed in your
> > example was NTDLL, an internal Windows DLL, but what it was doing is
> > hardly the cause of the memory corruption -- it is clearly the victim
> > of some other memory corrupting code. It is usually beneficial to
> > enable PageHeap to catch many (but not all) code that corrupt memory
> > as it corrupts its, which is like catching a crook red-handed.
>
> > Microsoft publishes free Application Verifier as well as Debugging
> > Tools which do all these things (and more), as well as general
> > instructions on how to use them. It would be beneficial in your
> > situation to use them to diagnose your issue.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Sep 14, 5:02 am, GaneshBabu...@gmail.com wrote:
>
> > > Hi,
>
> > > We are running ASP application in IIS 6.0.
> > > But w3wp.exe crashes unexpectedly with the following message.
>
> > > An exception dialog appears and one of the following message is logged
> > > in event log
>
> > > And any one of the following are logged in the System log during the
> > > w3wp.exe exception:
> > > Message 1
>
> > > Event Type: Warning
> > > Event Source: W3SVC
> > > Event Category: None
> > > Event ID: 1009
> > > Date: Date
> > > Time: Time
> > > User: N/A
> > > Computer: ComputerName
> > > Description:
> > > A process serving application pool 'DefaultAppPool' terminated
> > > unexpectedly. The process id was '1234'. The process exit code was
> > > '0xc0000005'.
>
> > > Message 2
>
> > > Event Type: Warning
> > > Event Source: W3SVC
> > > Event Category: None
> > > Event ID: 1011
> > > Date: Date
> > > Time: Time
> > > User: N/A
> > > Computer: ComputerName
> > > Description:
> > > A process serving application pool 'DefaultAppPool' suffered a fatal
> > > communication error with the World Wide Web Publishing Service. The
> > > process id was '1234'. The data field contains the error number.
>
> > > Message 3
>
> > > Event Type: Warning
> > > Event Source: W3SVC
> > > Event Category: None
> > > Event ID: 1013
> > > Date: Date
> > > Time: Time
> > > User: N/A
> > > Computer: ComputerName
> > > Description:
> > > The process where application pool 'DefaultAppPool' was offered
> > > exceeded the time limitation in the middle of the shutdown. Process id
> > > was two '41 '
>
> > > At times, only any of the above entry is found in the event log
> > > without the w3wp.exe exception dialog.
>
> > > We have run Microsoft's debug tool(Debug Diag) and have captured the
> > > following
>
> > > Analysis Summary
> > > Type Description Recommendation
> > > Error In
> > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_=
Except­­=ADion_C0000005.dmp
> > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault in
> > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > > access violation exception (0xC0000005) when trying to read from
> > > memory location 0x00000002 on thread 8
>
> > > Heap corruption was detected in heap 0x00080000, however pageheap was
> > > not enabled in this dump. Please follow the instructions in the
> > > recommendation section for troubleshooting heap corruption issues.
>
> > > Current NTGlobalFlags value: 0x0 An access violation exception thrown
> > > by a heap memory manager function indicates heap corruption. Please
> > > follow the steps outlined in the following Knowledge Base article:
>
> > > 300966 Howto debug heap corruption issues in Internet Information
> > > Services (IIS)
> > > Warning 1 client connection(s) in
> > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_=
Except­­=ADion_C0000005.dmp
> > > have been executing a request for more than 90 seconds. Please see the
> > > Client Connections section of this report for more detailed
> > > information about the connection(s).
>
> > > Analysis Details
> > > Table Of Contents
> > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_=
Except­­=ADion_C0000005.dmp
>
> > > Top 5 threads by CPU time
>
> > > Thread report
>
> > > COM+ STA ThreadPool Report
>
> > > Well-Known COM STA Threads Report
>
> > > HTTP Report
>
> > > ASP Report
>
> > > Faulting Module Information
>
> > > Report for
> > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chance_=
Except­­=ADion_C0000005.dmp
> > > Type of Analysis Performed Combined Crash/Hang Analysis
> > > Machine Name INFCH02041
> > > Operating System Windows Server 2003 Service Pack 2
> > > Number Of Processors 2
> > > Process ID 4468
> > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> > > System Up-Time 4 day(s) 14:22:11
> > > Process Up-Time 0 day(s) 00:19:47
>
> > > Top 5 Threads by CPU time
> > > Note - Times include both user mode and kernel mode for each thread
> > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> > > Point for Thread: msvcrt!_endthreadex+2f
> > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> > > Point for Thread: msvcrt!_endthreadex+2f
> > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> > > Point for Thread: ntdll!RtlpWorkerThread
> > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> > > Point for Thread: LeakTrack!UnloadThread
> > > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> > > Point for Thread: msvcrt!_endthreadex+2f
>
> > > Thread report
>
> > > Thread 0 - System ID 2232
> > > Entry point w3wp!wmainCRTStartup
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.78
> > > Time spent in kernel mode 0 Days 0:0:0.406
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!NtWaitForSingleObject+c
> > > kernel32!WaitForSingleObjectEx+ac
> > > kernel32!WaitForSingleObject+12
> > > w3dt!WP_CONTEXT::RunMainThreadLoop+10
> > > w3dt!UlAtqStartListen+2d
> > > w3core!W3_SERVER::StartListen+bd
> > > w3core!UlW3Start+26e
> > > w3wp!wmain+22a
> > > w3wp!wmainCRTStartup+12f
> > > kernel32!BaseProcessStart+23
>
> > > Back to Top
>
> > > Thread 1 - System ID 4392
> > > Entry point ntdll!RtlpTimerThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.187
> > > Time spent in kernel mode 0 Days 0:0:0.234
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!NtDelayExecution+c
> > > ntdll!RtlpTimerThread+47
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 2 - System ID 5596
> > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.15
> > > Time spent in kernel mode 0 Days 0:0:0.312
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!ZwRemoveIoCompletion+c
> > > kernel32!GetQueuedCompletionStatus+29
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 3 - System ID 5460
> > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.0
> > > Time spent in kernel mode 0 Days 0:0:0.15
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!ZwRemoveIoCompletion+c
> > > kernel32!GetQueuedCompletionStatus+29
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 4 - System ID 2164
> > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.62
> > > Time spent in kernel mode 0 Days 0:0:0.218
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!ZwRemoveIoCompletion+c
> > > kernel32!GetQueuedCompletionStatus+29
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 5 - System ID 3476
> > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.31
> > > Time spent in kernel mode 0 Days 0:0:0.0
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!ZwRemoveIoCompletion+c
> > > kernel32!GetQueuedCompletionStatus+29
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 6 - System ID 2768
> > > Entry point ntdll!RtlpWaitThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.0
> > > Time spent in kernel mode 0 Days 0:0:0.296
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!NtWaitForMultipleObjects+c
> > > ntdll!RtlpWaitThread+161
> > > kernel32!BaseThreadStart+34
>
> > > Back to Top
>
> > > Thread 7 - System ID 5800
> > > Entry point w3core!HTTP_COMPRESSION::CompressionThread
> > > Create time 2007/09/11 10:11:06
> > > Time spent in user mode 0 Days 0:0:0.0
> > > Time spent in kernel mode 0 Days 0:0:0.281
>
> > > Function Source
> > > ntdll!KiFastSystemCallRet
> > > ntdll!NtWaitForSingleObject+c
> > > kernel32!WaitForSingleObjectEx+ac
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Yes Sir our code is ASP, but we do use COM DLLs for Database
connectivity and Logging. When we analyzed the memory leaks we found
out that the BSTR were not freed using SysFreeString(). When we called
SysFreeString also the same problem persists. Sometimes we get an
exception dialog from w3wp.exe, it is an memory exception. I
downloaded Application verifier from micorosoft site but Iam not able
to execute w3wp.exe using the verifier. When Debug diag is not
runnning the exception dialog apperas and event log entries are
created, but if Debug diag is executed then the Exception dialog does
not appear and only event log entries are created. Please help me in
how to use Appverifier for w3wp.exe service and suggest me some method
through which i can identify the cause of the problem.

Thanks in Advance

On Sep 18, 1:23 am, David Wang wrote:
> It *could*, but I consider it the last option to explore because if it
> is a problem with IIS/Windows, the issue would be hit far more
> frequently and honestly we haven't seen such a deluge. I realize that
> users usually trust their own code and not Microsoft's, but history
> has shown that to be an incorrect assumption. Put in another way -- if
> your application gets used by 100 million people in countless
> different ways, how likely do you think it'd have issues?
>
> ISAPI DLL is a common cause but not the only. Are you running *any*
> third party code with your application. I see that your application is
> ASP, so it is purely ASP which does not do *any* Server.CreateObject()
> or new ActiveXObject() calls? Those calls would load other native
> code into the web server that could crash, even if your web page is
> pure ASP.
>
> I'm also going to have to check if that "crash" is one of the expected
> exceptions -- there's a couple of internal Windows APIs that actually
> use exceptions as a normal part of operation and should be ignored by
> the debugger. I could have sworn ntdll!
> ExpInterlockedPopEntrySListFault is one of them.
>
> Does this happen if you do not run DebugDiag to track memory leaks?
> Because you have a crash, not memory leak, and they are tracked
> differently
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Sep 16, 9:52 pm, GaneshBabu...@gmail.com wrote:
>
>
>
> > Thanks for the help. But we dont use any ISAPI DLLs in our
> > application. We reviewed the code for memory leaks but didnt find any
> > problem. This problem is occurring only in windows 2003 R2 SP2. Will
> > it be a problem with 2003 R2?
>
> > On Sep 16, 12:14 pm, David Wang wrote:
>
> > > Your application is running native code which is crashing the worker
> > > process (that's what 0xc0000005 means).
>
> > > There is also signs of memory corruption in the worker process. It
> > > *may* be the cause of the crash (in which case you have one issue), or
> > > it may not (which means you have more than one issue within your
> > > website).
>
> > > Please start by identifying all custom ISAPI Filter DLL and ISAPI
> > > Extension DLL loaded on your server.
>
> > > When there is signs of memory corruption, the code that actually
> > > crashed may *not* be the culprit but rather unfortunate victim of the
> > > memory corrupting code. For example, the code that crashed in your
> > > example was NTDLL, an internal Windows DLL, but what it was doing is
> > > hardly the cause of the memory corruption -- it is clearly the victim
> > > of some other memory corrupting code. It is usually beneficial to
> > > enable PageHeap to catch many (but not all) code that corrupt memory
> > > as it corrupts its, which is like catching a crook red-handed.
>
> > > Microsoft publishes free Application Verifier as well as Debugging
> > > Tools which do all these things (and more), as well as general
> > > instructions on how to use them. It would be beneficial in your
> > > situation to use them to diagnose your issue.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Sep 14, 5:02 am, GaneshBabu...@gmail.com wrote:
>
> > > > Hi,
>
> > > > We are running ASP application in IIS 6.0.
> > > > But w3wp.exe crashes unexpectedly with the following message.
>
> > > > An exception dialog appears and one of the following message is log=
ged
> > > > in event log
>
> > > > And any one of the following are logged in the System log during the
> > > > w3wp.exe exception:
> > > > Message 1
>
> > > > Event Type: Warning
> > > > Event Source: W3SVC
> > > > Event Category: None
> > > > Event ID: 1009
> > > > Date: Date
> > > > Time: Time
> > > > User: N/A
> > > > Computer: ComputerName
> > > > Description:
> > > > A process serving application pool 'DefaultAppPool' terminated
> > > > unexpectedly. The process id was '1234'. The process exit code was
> > > > '0xc0000005'.
>
> > > > Message 2
>
> > > > Event Type: Warning
> > > > Event Source: W3SVC
> > > > Event Category: None
> > > > Event ID: 1011
> > > > Date: Date
> > > > Time: Time
> > > > User: N/A
> > > > Computer: ComputerName
> > > > Description:
> > > > A process serving application pool 'DefaultAppPool' suffered a fatal
> > > > communication error with the World Wide Web Publishing Service. The
> > > > process id was '1234'. The data field contains the error number.
>
> > > > Message 3
>
> > > > Event Type: Warning
> > > > Event Source: W3SVC
> > > > Event Category: None
> > > > Event ID: 1013
> > > > Date: Date
> > > > Time: Time
> > > > User: N/A
> > > > Computer: ComputerName
> > > > Description:
> > > > The process where application pool 'DefaultAppPool' was offered
> > > > exceeded the time limitation in the middle of the shutdown. Process=
id
> > > > was two '41 '
>
> > > > At times, only any of the above entry is found in the event log
> > > > without the w3wp.exe exception dialog.
>
> > > > We have run Microsoft's debug tool(Debug Diag) and have captured t=
he
> > > > following
>
> > > > Analysis Summary
> > > > Type Description Recommendation
> > > > Error In
> > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chanc=
e_Except­­­­ion_C0000005.dmp
> > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFault =
in
> > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused=
an
> > > > access violation exception (0xC0000005) when trying to read from
> > > > memory location 0x00000002 on thread 8
>
> > > > Heap corruption was detected in heap 0x00080000, however pageheap w=
as
> > > > not enabled in this dump. Please follow the instructions in the
> > > > recommendation section for troubleshooting heap corruption issues.
>
> > > > Current NTGlobalFlags value: 0x0 An access violation exception thro=
wn
> > > > by a heap memory manager function indicates heap corruption. Please
> > > > follow the steps outlined in the following Knowledge Base article:
>
> > > > 300966 Howto debug heap corruption issues in Internet Information
> > > > Services (IIS)
> > > > Warning 1 client connection(s) in
> > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chanc=
e_Except­­­­ion_C0000005.dmp
> > > > have been executing a request for more than 90 seconds. Please see =
the
> > > > Client Connections section of this report for more detailed
> > > > information about the connection(s).
>
> > > > Analysis Details
> > > > Table Of Contents
> > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chanc=
e_Except­­­­ion_C0000005.dmp
>
> > > > Top 5 threads by CPU time
>
> > > > Thread report
>
> > > > COM+ STA ThreadPool Report
>
> > > > Well-Known COM STA Threads Report
>
> > > > HTTP Report
>
> > > > ASP Report
>
> > > > Faulting Module Information
>
> > > > Report for
> > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Chanc=
e_Except­­­­ion_C0000005.dmp
> > > > Type of Analysis Performed Combined Crash/Hang Analysis
> > > > Machine Name INFCH02041
> > > > Operating System Windows Server 2003 Service Pack 2
> > > > Number Of Processors 2
> > > > Process ID 4468
> > > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> > > > System Up-Time 4 day(s) 14:22:11
> > > > Process Up-Time 0 day(s) 00:19:47
>
> > > > Top 5 Threads by CPU time
> > > > Note - Times include both user mode and kernel mode for each thread
> > > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> > > > Point for Thread: ntdll!RtlpWorkerThread
> > > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> > > > Point for Thread: LeakTrack!UnloadThread
> > > > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> > > > Point for Thread: msvcrt!_endthreadex+2f
>
> > > > Thread report
>
> > > > Thread 0 - System ID 2232
> > > > Entry point w3wp!wmainCRTStartup
> > > > Create time 2007/09/11 10:11:06
> > > > Time spent in user mode 0 Days 0:0:0.78
> > > > Time spent in kernel mode 0 Days 0:0:0.406
>
> > > > Function Source
> > > > ntdll!KiFastSystemCallRet
> > > > ntdll!NtWaitForSingleObject+c
> > > > kernel32!WaitForSingleObjectEx+ac
> > > > kernel32!WaitForSingleObject+12
> > > > w3dt!WP_CONTEXT::RunMainThreadLoop+10
> > > > w3dt!UlAtqStartListen+2d
> > > > w3core!W3_SERVER::StartListen+bd
> > > > w3core!UlW3Start+26e
> > > > w3wp!wmain+22a
> > > > w3wp!wmainCRTStartup+12f
> > > > kernel32!BaseProcessStart+23
>
> > > > Back to Top
>
> > > > Thread 1 - System ID 4392
> > > > Entry point ntdll!RtlpTimerThread
> > > > Create time 2007/09/11 10:11:06
> > > > Time spent in user mode 0 Days 0:0:0.187
> > > > Time spent in kernel mode 0 Days 0:0:0.234
>
> > > > Function Source
> > > > ntdll!KiFastSystemCallRet
> > > > ntdll!NtDelayExecution+c
> > > > ntdll!RtlpTimerThread+47
> > > > kernel32!BaseThreadStart+34
>
> > > > Back to Top
>
> > > > Thread 2 - System ID 5596
> > > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > > Create time 2007/09/11 10:11:06
> > > > Time spent in user mode 0 Days 0:0:0.15
> > > > Time spent in kernel mode 0 Days 0:0:0.312
>
> > > > Function Source
> > > > ntdll!KiFastSystemCallRet
> > > > ntdll!ZwRemoveIoCompletion+c
> > > > kernel32!GetQueuedCompletionStatus+29
> > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > > kernel32!BaseThreadStart+34
>
> > > > Back to Top
>
> > > > Thread 3 - System ID 5460
> > > > Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
> > > > Create time 2007/09/11 10:11:06
> > > > Time spent in user mode 0 Days 0:0:0.0
> > > > Time spent in kernel mode 0 Days 0:0:0.15
>
> > > > Function Source
> > > > ntdll!KiFastSystemCallRet
> > > > ntdll!ZwRemoveIoCompletion+c
> > > > kernel32!GetQueuedCompletionStatus+29
> > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
> > > > w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
> > > > w3tp!THREAD_MANAGER::ThreadManagerThread+39
> > > > kernel32!BaseThreadStart+34
>
> > > > Back to Top
>
> > > > Thread 4 - System ID 2164
> > > > Entry
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Following the strategy that I outline at:
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Un derstand_and_Di=
agnose_an_AppPool_Crash.aspx

We are going after the issues one at a time, not all at once.

We know there is memory corruption. I would use Application Verifier
and enable "Page Heap" on w3wp.exe, and then try to reproduce the
issue.

When it happens, Application Verifier will break into the process. If
you happen to have a debugger attached, you can directly observe the
culprit.

How to do this is beyond the scope of this newsgroup. You can either
learn on your own, pay someone else to learn, or pay someone else to
do it.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//





On Sep 17, 11:52 pm, GaneshBabu...@gmail.com wrote:
> Yes Sir our code is ASP, but we do use COM DLLs for Database
> connectivity and Logging. When we analyzed the memory leaks we found
> out that the BSTR were not freed using SysFreeString(). When we called
> SysFreeString also the same problem persists. Sometimes we get an
> exception dialog from w3wp.exe, it is an memory exception. I
> downloaded Application verifier from micorosoft site but Iam not able
> to execute w3wp.exe using the verifier. When Debug diag is not
> runnning the exception dialog apperas and event log entries are
> created, but if Debug diag is executed then the Exception dialog does
> not appear and only event log entries are created. Please help me in
> how to use Appverifier for w3wp.exe service and suggest me some method
> through which i can identify the cause of the problem.
>
> Thanks in Advance
>
> On Sep 18, 1:23 am, David Wang wrote:
>
>
>
> > It *could*, but I consider it the last option to explore because if it
> > is a problem with IIS/Windows, the issue would be hit far more
> > frequently and honestly we haven't seen such a deluge. I realize that
> > users usually trust their own code and not Microsoft's, but history
> > has shown that to be an incorrect assumption. Put in another way -- if
> > your application gets used by 100 million people in countless
> > different ways, how likely do you think it'd have issues?
>
> > ISAPI DLL is a common cause but not the only. Are you running *any*
> > third party code with your application. I see that your application is
> > ASP, so it is purely ASP which does not do *any* Server.CreateObject()
> > or new ActiveXObject() calls? Those calls would load other native
> > code into the web server that could crash, even if your web page is
> > pure ASP.
>
> > I'm also going to have to check if that "crash" is one of the expected
> > exceptions -- there's a couple of internal Windows APIs that actually
> > use exceptions as a normal part of operation and should be ignored by
> > the debugger. I could have sworn ntdll!
> > ExpInterlockedPopEntrySListFault is one of them.
>
> > Does this happen if you do not run DebugDiag to track memory leaks?
> > Because you have a crash, not memory leak, and they are tracked
> > differently
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Sep 16, 9:52 pm, GaneshBabu...@gmail.com wrote:
>
> > > Thanks for the help. But we dont use any ISAPI DLLs in our
> > > application. We reviewed the code for memory leaks but didnt find any
> > > problem. This problem is occurring only in windows 2003 R2 SP2. Will
> > > it be a problem with 2003 R2?
>
> > > On Sep 16, 12:14 pm, David Wang wrote:
>
> > > > Your application is running native code which is crashing the worker
> > > > process (that's what 0xc0000005 means).
>
> > > > There is also signs of memory corruption in the worker process. It
> > > > *may* be the cause of the crash (in which case you have one issue),=
or
> > > > it may not (which means you have more than one issue within your
> > > > website).
>
> > > > Please start by identifying all custom ISAPI Filter DLL and ISAPI
> > > > Extension DLL loaded on your server.
>
> > > > When there is signs of memory corruption, the code that actually
> > > > crashed may *not* be the culprit but rather unfortunate victim of t=
he
> > > > memory corrupting code. For example, the code that crashed in your
> > > > example was NTDLL, an internal Windows DLL, but what it was doing is
> > > > hardly the cause of the memory corruption -- it is clearly the vict=
im
> > > > of some other memory corrupting code. It is usually beneficial to
> > > > enable PageHeap to catch many (but not all) code that corrupt memory
> > > > as it corrupts its, which is like catching a crook red-handed.
>
> > > > Microsoft publishes free Application Verifier as well as Debugging
> > > > Tools which do all these things (and more), as well as general
> > > > instructions on how to use them. It would be beneficial in your
> > > > situation to use them to diagnose your issue.
>
> > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > //
>
> > > > On Sep 14, 5:02 am, GaneshBabu...@gmail.com wrote:
>
> > > > > Hi,
>
> > > > > We are running ASP application in IIS 6.0.
> > > > > But w3wp.exe crashes unexpectedly with the following message.
>
> > > > > An exception dialog appears and one of the following message is l=
ogged
> > > > > in event log
>
> > > > > And any one of the following are logged in the System log during =
the
> > > > > w3wp.exe exception:
> > > > > Message 1
>
> > > > > Event Type: Warning
> > > > > Event Source: W3SVC
> > > > > Event Category: None
> > > > > Event ID: 1009
> > > > > Date: Date
> > > > > Time: Time
> > > > > User: N/A
> > > > > Computer: ComputerName
> > > > > Description:
> > > > > A process serving application pool 'DefaultAppPool' terminated
> > > > > unexpectedly. The process id was '1234'. The process exit code was
> > > > > '0xc0000005'.
>
> > > > > Message 2
>
> > > > > Event Type: Warning
> > > > > Event Source: W3SVC
> > > > > Event Category: None
> > > > > Event ID: 1011
> > > > > Date: Date
> > > > > Time: Time
> > > > > User: N/A
> > > > > Computer: ComputerName
> > > > > Description:
> > > > > A process serving application pool 'DefaultAppPool' suffered a fa=
tal
> > > > > communication error with the World Wide Web Publishing Service. T=
he
> > > > > process id was '1234'. The data field contains the error number.
>
> > > > > Message 3
>
> > > > > Event Type: Warning
> > > > > Event Source: W3SVC
> > > > > Event Category: None
> > > > > Event ID: 1013
> > > > > Date: Date
> > > > > Time: Time
> > > > > User: N/A
> > > > > Computer: ComputerName
> > > > > Description:
> > > > > The process where application pool 'DefaultAppPool' was offered
> > > > > exceeded the time limitation in the middle of the shutdown. Proce=
ss id
> > > > > was two '41 '
>
> > > > > At times, only any of the above entry is found in the event log
> > > > > without the w3wp.exe exception dialog.
>
> > > > > We have run Microsoft's debug tool(Debug Diag) and have captured=
the
> > > > > following
>
> > > > > Analysis Summary
> > > > > Type Description Recommendation
> > > > > Error In
> > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Cha=
nce_Except­­­­=ADion_C0000005.dmp
> > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFaul=
t in
> > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caus=
ed an
> > > > > access violation exception (0xC0000005) when trying to read from
> > > > > memory location 0x00000002 on thread 8
>
> > > > > Heap corruption was detected in heap 0x00080000, however pageheap=
was
> > > > > not enabled in this dump. Please follow the instructions in the
> > > > > recommendation section for troubleshooting heap corruption issues.
>
> > > > > Current NTGlobalFlags value: 0x0 An access violation exception th=
rown
> > > > > by a heap memory manager function indicates heap corruption. Plea=
se
> > > > > follow the steps outlined in the following Knowledge Base article:
>
> > > > > 300966 Howto debug heap corruption issues in Internet Information
> > > > > Services (IIS)
> > > > > Warning 1 client connection(s) in
> > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Cha=
nce_Except­­­­=ADion_C0000005.dmp
> > > > > have been executing a request for more than 90 seconds. Please se=
e the
> > > > > Client Connections section of this report for more detailed
> > > > > information about the connection(s).
>
> > > > > Analysis Details
> > > > > Table Of Contents
> > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Cha=
nce_Except­­­­=ADion_C0000005.dmp
>
> > > > > Top 5 threads by CPU time
>
> > > > > Thread report
>
> > > > > COM+ STA ThreadPool Report
>
> > > > > Well-Known COM STA Threads Report
>
> > > > > HTTP Report
>
> > > > > ASP Report
>
> > > > > Faulting Module Information
>
> > > > > Report for
> > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_Cha=
nce_Except­­­­=ADion_C0000005.dmp
> > > > > Type of Analysis Performed Combined Crash/Hang Analysis
> > > > > Machine Name INFCH02041
> > > > > Operating System Windows Server 2003 Service Pack 2
> > > > > Number Of Processors 2
> > > > > Process ID 4468
> > > > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> > > > > System Up-Time 4 day(s) 14:22:11
> > > > > Process Up-Time 0 day(s) 00:19:47
>
> > > > > Top 5 Threads by CPU time
> > > > > Note - Times include both user mode and kernel mode for each thre=
ad
> > > > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Entry
> > > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Entry
> > > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Entry
> > > > > Point for Thread: ntdll!RtlpWorkerThread
> > > > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Entry
> > > > > Point for Thread: LeakTrack!UnloadThread
> > > > > Thread ID: 19 Total CPU Time: 0 day(s) 00:00:00.578 Entry
> > > > > Point for Thread: msvcrt!_endthreadex+2f
>
> > > > > Thread report
>
> > > > > Thread 0 - System ID 2232
> > > > > Entry point w3wp!wmainCRTStartup
> > > > > Create time 2007/09/11 10:11:06
> > > > > Time spent in user mode 0 Days 0:0:0.78
> > > > > Time spent in kernel mode 0 Days 0:0:0.406
>
> > > > > Function Source
> > > > > ntdll!KiFastSystemCallRet
> > > > > ntdll!NtWaitForSingleObject+c
> > > > > kernel32!WaitForSingleObjectEx+ac
> > > > > kernel32!WaitForSingleObject+12
> > > > > w3dt!WP_CONTEXT::RunMainThreadLoop+10
> > > > > w3dt!UlAtqStartListen+2d
> > > > > w3core!W3_SERVER::StartListen+bd
> > > > > w3core!UlW3Start+26e
> > > > > w3wp!wmain+22a
> > > > > w3wp!wmainCRTStartup+12f
> > > > > kernel32!BaseProcessStart+23
>
> > > > > Back to Top
>
> > > > > Thread 1 - System ID 4392
> > > > > Entry point ntdll!RtlpTimerThread
> > > > > Create time 2007/09/11 10:11:06
> > > > > Time spent in user mode 0 Days 0:0:0.187
> > > > > Time spent in kernel mode 0 Days 0:0:0.234
>
> > > > > Function Source
> > > > > ntdll!KiFastSystemCallRet
> > > > > ntdll!NtDelayExecution+c
> > > > > ntdll!RtlpTimerThread+47
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Dear Sir
In order to simulate the memory problem we executed our
application for almost 48 hours continiously. We didnt get any memory
exception but after 48 hours the session was cut and the following
message was logged in the event log

A process serving application pool DefaultAppPool exceeded time limits
during shut down. The process id was process id.

Event ID - 1013

Is it a problem or it is because our application ran for a long time
the process was shutdown.


On Sep 18, 12:55 pm, David Wang wrote:
> Following the strategy that I outline at:http://blogs.msdn.com/david.wang=
/archive/2005/08/29/HOWTO_Understand_...
>
> We are going after the issues one at a time, not all at once.
>
> We know there is memory corruption. I would use Application Verifier
> and enable "Page Heap" on w3wp.exe, and then try to reproduce the
> issue.
>
> When it happens, Application Verifier will break into the process. If
> you happen to have a debugger attached, you can directly observe the
> culprit.
>
> How to do this is beyond the scope of this newsgroup. You can either
> learn on your own, pay someone else to learn, or pay someone else to
> do it.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Sep 17, 11:52 pm,GaneshBabu...@gmail.com wrote:
>
>
>
> > Yes Sir our code is ASP, but we do use COM DLLs for Database
> > connectivity and Logging. When we analyzed the memory leaks we found
> > out that the BSTR were not freed using SysFreeString(). When we called
> > SysFreeString also the same problem persists. Sometimes we get an
> > exception dialog from w3wp.exe, it is an memory exception. I
> > downloaded Application verifier from micorosoft site but Iam not able
> > to execute w3wp.exe using the verifier. When Debug diag is not
> > runnning the exception dialog apperas and event log entries are
> > created, but if Debug diag is executed then the Exception dialog does
> > not appear and only event log entries are created. Please help me in
> > how to use Appverifier for w3wp.exe service and suggest me some method
> > through which i can identify the cause of the problem.
>
> > Thanks in Advance
>
> > On Sep 18, 1:23 am, David Wang wrote:
>
> > > It *could*, but I consider it the last option to explore because if it
> > > is a problem with IIS/Windows, the issue would be hit far more
> > > frequently and honestly we haven't seen such a deluge. I realize that
> > > users usually trust their own code and not Microsoft's, but history
> > > has shown that to be an incorrect assumption. Put in another way -- if
> > > your application gets used by 100 million people in countless
> > > different ways, how likely do you think it'd have issues?
>
> > > ISAPI DLL is a common cause but not the only. Are you running *any*
> > > third party code with your application. I see that your application is
> > > ASP, so it is purely ASP which does not do *any* Server.CreateObject()
> > > or new ActiveXObject() calls? Those calls would load other native
> > > code into the web server that could crash, even if your web page is
> > > pure ASP.
>
> > > I'm also going to have to check if that "crash" is one of the expected
> > > exceptions -- there's a couple of internal Windows APIs that actually
> > > use exceptions as a normal part of operation and should be ignored by
> > > the debugger. I could have sworn ntdll!
> > > ExpInterlockedPopEntrySListFault is one of them.
>
> > > Does this happen if you do not run DebugDiag to track memory leaks?
> > > Because you have a crash, not memory leak, and they are tracked
> > > differently
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Sep 16, 9:52 pm,GaneshBabu...@gmail.com wrote:
>
> > > > Thanks for the help. But we dont use any ISAPI DLLs in our
> > > > application. We reviewed the code for memory leaks but didnt find =
any
> > > > problem. This problem is occurring only in windows 2003 R2 SP2. Will
> > > > it be a problem with 2003 R2?
>
> > > > On Sep 16, 12:14 pm, David Wang wrote:
>
> > > > > Your application is running native code which is crashing the wor=
ker
> > > > > process (that's what 0xc0000005 means).
>
> > > > > There is also signs of memory corruption in the worker process. It
> > > > > *may* be the cause of the crash (in which case you have one issue=
), or
> > > > > it may not (which means you have more than one issue within your
> > > > > website).
>
> > > > > Please start by identifying all custom ISAPI Filter DLL and ISAPI
> > > > > Extension DLL loaded on your server.
>
> > > > > When there is signs of memory corruption, the code that actually
> > > > > crashed may *not* be the culprit but rather unfortunate victim of=
the
> > > > > memory corrupting code. For example, the code that crashed in your
> > > > > example was NTDLL, an internal Windows DLL, but what it was doing=
is
> > > > > hardly the cause of the memory corruption -- it is clearly the vi=
ctim
> > > > > of some other memory corrupting code. It is usually beneficial to
> > > > > enable PageHeap to catch many (but not all) code that corrupt mem=
ory
> > > > > as it corrupts its, which is like catching a crook red-handed.
>
> > > > > Microsoft publishes free Application Verifier as well as Debugging
> > > > > Tools which do all these things (and more), as well as general
> > > > > instructions on how to use them. It would be beneficial in your
> > > > > situation to use them to diagnose your issue.
>
> > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > > //
>
> > > > > On Sep 14, 5:02 am,GaneshBabu...@gmail.com wrote:
>
> > > > > > Hi,
>
> > > > > > We are running ASP application in IIS 6.0.
> > > > > > But w3wp.exe crashes unexpectedly with the following message.
>
> > > > > > An exception dialog appears and one of the following message is=
logged
> > > > > > in event log
>
> > > > > > And any one of the following are logged in the System log durin=
g the
> > > > > > w3wp.exe exception:
> > > > > > Message 1
>
> > > > > > Event Type: Warning
> > > > > > Event Source: W3SVC
> > > > > > Event Category: None
> > > > > > Event ID: 1009
> > > > > > Date: Date
> > > > > > Time: Time
> > > > > > User: N/A
> > > > > > Computer: ComputerName
> > > > > > Description:
> > > > > > A process serving application pool 'DefaultAppPool' terminated
> > > > > > unexpectedly. The process id was '1234'. The process exit code =
was
> > > > > > '0xc0000005'.
>
> > > > > > Message 2
>
> > > > > > Event Type: Warning
> > > > > > Event Source: W3SVC
> > > > > > Event Category: None
> > > > > > Event ID: 1011
> > > > > > Date: Date
> > > > > > Time: Time
> > > > > > User: N/A
> > > > > > Computer: ComputerName
> > > > > > Description:
> > > > > > A process serving application pool 'DefaultAppPool' suffered a =
fatal
> > > > > > communication error with the World Wide Web Publishing Service.=
The
> > > > > > process id was '1234'. The data field contains the error number.
>
> > > > > > Message 3
>
> > > > > > Event Type: Warning
> > > > > > Event Source: W3SVC
> > > > > > Event Category: None
> > > > > > Event ID: 1013
> > > > > > Date: Date
> > > > > > Time: Time
> > > > > > User: N/A
> > > > > > Computer: ComputerName
> > > > > > Description:
> > > > > > The process where application pool 'DefaultAppPool' was offered
> > > > > > exceeded the time limitation in the middle of the shutdown. Pro=
cess id
> > > > > > was two '41 '
>
> > > > > > At times, only any of the above entry is found in the event log
> > > > > > without the w3wp.exe exception dialog.
>
> > > > > > We have run Microsoft's debug tool(Debug Diag) and have captur=
ed the
> > > > > > following
>
> > > > > > Analysis Summary
> > > > > > Type Description Recommendation
> > > > > > Error In
> > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_C=
hance_Except­­­­­­ion_C0000005.dmp
> > > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySListFa=
ult in
> > > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has ca=
used an
> > > > > > access violation exception (0xC0000005) when trying to read from
> > > > > > memory location 0x00000002 on thread 8
>
> > > > > > Heap corruption was detected in heap 0x00080000, however pagehe=
ap was
> > > > > > not enabled in this dump. Please follow the instructions in the
> > > > > > recommendation section for troubleshooting heap corruption issu=
es.
>
> > > > > > Current NTGlobalFlags value: 0x0 An access violation exception =
thrown
> > > > > > by a heap memory manager function indicates heap corruption. Pl=
ease
> > > > > > follow the steps outlined in the following Knowledge Base artic=
le:
>
> > > > > > 300966 Howto debug heap corruption issues in Internet Informati=
on
> > > > > > Services (IIS)
> > > > > > Warning 1 client connection(s) in
> > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_C=
hance_Except­­­­­­ion_C0000005.dmp
> > > > > > have been executing a request for more than 90 seconds. Please =
see the
> > > > > > Client Connections section of this report for more detailed
> > > > > > information about the connection(s).
>
> > > > > > Analysis Details
> > > > > > Table Of Contents
> > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_C=
hance_Except­­­­­­ion_C0000005.dmp
>
> > > > > > Top 5 threads by CPU time
>
> > > > > > Thread report
>
> > > > > > COM+ STA ThreadPool Report
>
> > > > > > Well-Known COM STA Threads Report
>
> > > > > > HTTP Report
>
> > > > > > ASP Report
>
> > > > > > Faulting Module Information
>
> > > > > > Report for
> > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d_C=
hance_Except­­­­­­ion_C0000005.dmp
> > > > > > Type of Analysis Performed Combined Crash/Hang Analysis
> > > > > > Machine Name INFCH02041
> > > > > > Operating System Windows Server 2003 Service Pack 2
> > > > > > Number Of Processors 2
> > > > > > Process ID 4468
> > > > > > Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
> > > > > > System Up-Time 4 day(s) 14:22:11
> > > > > > Process Up-Time 0 day(s) 00:19:47
>
> > > > > > Top 5 Threads by CPU time
> > > > > > Note - Times include both user mode and kernel mode for each th=
read
> > > > > > Thread ID: 18 Total CPU Time: 0 day(s) 00:11:35.953 Ent=
ry
> > > > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > > > Thread ID: 20 Total CPU Time: 0 day(s) 00:00:37.250 Ent=
ry
> > > > > > Point for Thread: msvcrt!_endthreadex+2f
> > > > > > Thread ID: 27 Total CPU Time: 0 day(s) 00:00:00.875 Ent=
ry
> > > > > > Point for Thread: ntdll!RtlpWorkerThread
> > > > > > Thread ID: 26 Total CPU Time: 0 day(s) 00:00:00.718 Ent=
ry
> > > > > > Point for Thread: LeakTrack!UnloadThread
> > > > > > Thread ID: 19 Total CPU Time: 0
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Neither.

The event log entry indicates that something inside the worker process
prevented it from shutting down within its configured time limit when
IIS told it to recycle due to some other recycling metric.

The appropriate values are all depending on your server's
configuration.

I recommend running Application Verifier while you simulate using your
application to try and find the memory problem.

Of course, since there was no clear reproduction steps, you have no
guarantee that what you are doing will actuall result in the memory
issue you are looking for. So, you could be just wasting time. Or not.
No one really knows. That's the unfortunate nature of bugs.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//





On Sep 20, 9:26 pm, GaneshBabu...@gmail.com wrote:
> Dear Sir
> In order to simulate the memory problem we executed our
> application for almost 48 hours continiously. We didnt get any memory
> exception but after 48 hours the session was cut and the following
> message was logged in the event log
>
> A process serving application pool DefaultAppPool exceeded time limits
> during shut down. The process id was process id.
>
> Event ID - 1013
>
> Is it a problem or it is because our application ran for a long time
> the process was shutdown.
>
> On Sep 18, 12:55 pm, David Wang wrote:
>
>
>
> > Following the strategy that I outline at:http://blogs.msdn.com/david.wa=
ng/archive/2005/08/29/HOWTO_Understand_...
>
> > We are going after the issues one at a time, not all at once.
>
> > We know there is memory corruption. I would use Application Verifier
> > and enable "Page Heap" on w3wp.exe, and then try to reproduce the
> > issue.
>
> > When it happens, Application Verifier will break into the process. If
> > you happen to have a debugger attached, you can directly observe the
> > culprit.
>
> > How to do this is beyond the scope of this newsgroup. You can either
> > learn on your own, pay someone else to learn, or pay someone else to
> > do it.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //
>
> > On Sep 17, 11:52 pm,GaneshBabu...@gmail.com wrote:
>
> > > Yes Sir our code is ASP, but we do use COM DLLs for Database
> > > connectivity and Logging. When we analyzed the memory leaks we found
> > > out that the BSTR were not freed using SysFreeString(). When we called
> > > SysFreeString also the same problem persists. Sometimes we get an
> > > exception dialog from w3wp.exe, it is an memory exception. I
> > > downloaded Application verifier from micorosoft site but Iam not able
> > > to execute w3wp.exe using the verifier. When Debug diag is not
> > > runnning the exception dialog apperas and event log entries are
> > > created, but if Debug diag is executed then the Exception dialog does
> > > not appear and only event log entries are created. Please help me in
> > > how to use Appverifier for w3wp.exe service and suggest me some method
> > > through which i can identify the cause of the problem.
>
> > > Thanks in Advance
>
> > > On Sep 18, 1:23 am, David Wang wrote:
>
> > > > It *could*, but I consider it the last option to explore because if=
it
> > > > is a problem with IIS/Windows, the issue would be hit far more
> > > > frequently and honestly we haven't seen such a deluge. I realize th=
at
> > > > users usually trust their own code and not Microsoft's, but history
> > > > has shown that to be an incorrect assumption. Put in another way --=
if
> > > > your application gets used by 100 million people in countless
> > > > different ways, how likely do you think it'd have issues?
>
> > > > ISAPI DLL is a common cause but not the only. Are you running *any*
> > > > third party code with your application. I see that your application=
is
> > > > ASP, so it is purely ASP which does not do *any* Server.CreateObjec=
t()
> > > > or new ActiveXObject() calls? Those calls would load other native
> > > > code into the web server that could crash, even if your web page is
> > > > pure ASP.
>
> > > > I'm also going to have to check if that "crash" is one of the expec=
ted
> > > > exceptions -- there's a couple of internal Windows APIs that actual=
ly
> > > > use exceptions as a normal part of operation and should be ignored =
by
> > > > the debugger. I could have sworn ntdll!
> > > > ExpInterlockedPopEntrySListFault is one of them.
>
> > > > Does this happen if you do not run DebugDiag to track memory leaks?
> > > > Because you have a crash, not memory leak, and they are tracked
> > > > differently
>
> > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > //
>
> > > > On Sep 16, 9:52 pm,GaneshBabu...@gmail.com wrote:
>
> > > > > Thanks for the help. But we dont use any ISAPI DLLs in our
> > > > > application. We reviewed the code for memory leaks but didnt fin=
d any
> > > > > problem. This problem is occurring only in windows 2003 R2 SP2. W=
ill
> > > > > it be a problem with 2003 R2?
>
> > > > > On Sep 16, 12:14 pm, David Wang wrote:
>
> > > > > > Your application is running native code which is crashing the w=
orker
> > > > > > process (that's what 0xc0000005 means).
>
> > > > > > There is also signs of memory corruption in the worker process.=
It
> > > > > > *may* be the cause of the crash (in which case you have one iss=
ue), or
> > > > > > it may not (which means you have more than one issue within your
> > > > > > website).
>
> > > > > > Please start by identifying all custom ISAPI Filter DLL and ISA=
PI
> > > > > > Extension DLL loaded on your server.
>
> > > > > > When there is signs of memory corruption, the code that actually
> > > > > > crashed may *not* be the culprit but rather unfortunate victim =
of the
> > > > > > memory corrupting code. For example, the code that crashed in y=
our
> > > > > > example was NTDLL, an internal Windows DLL, but what it was doi=
ng is
> > > > > > hardly the cause of the memory corruption -- it is clearly the =
victim
> > > > > > of some other memory corrupting code. It is usually beneficial =
to
> > > > > > enable PageHeap to catch many (but not all) code that corrupt m=
emory
> > > > > > as it corrupts its, which is like catching a crook red-handed.
>
> > > > > > Microsoft publishes free Application Verifier as well as Debugg=
ing
> > > > > > Tools which do all these things (and more), as well as general
> > > > > > instructions on how to use them. It would be beneficial in your
> > > > > > situation to use them to diagnose your issue.
>
> > > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > > > //
>
> > > > > > On Sep 14, 5:02 am,GaneshBabu...@gmail.com wrote:
>
> > > > > > > Hi,
>
> > > > > > > We are running ASP application in IIS 6.0.
> > > > > > > But w3wp.exe crashes unexpectedly with the following message.
>
> > > > > > > An exception dialog appears and one of the following message =
is logged
> > > > > > > in event log
>
> > > > > > > And any one of the following are logged in the System log dur=
ing the
> > > > > > > w3wp.exe exception:
> > > > > > > Message 1
>
> > > > > > > Event Type: Warning
> > > > > > > Event Source: W3SVC
> > > > > > > Event Category: None
> > > > > > > Event ID: 1009
> > > > > > > Date: Date
> > > > > > > Time: Time
> > > > > > > User: N/A
> > > > > > > Computer: ComputerName
> > > > > > > Description:
> > > > > > > A process serving application pool 'DefaultAppPool' terminated
> > > > > > > unexpectedly. The process id was '1234'. The process exit cod=
e was
> > > > > > > '0xc0000005'.
>
> > > > > > > Message 2
>
> > > > > > > Event Type: Warning
> > > > > > > Event Source: W3SVC
> > > > > > > Event Category: None
> > > > > > > Event ID: 1011
> > > > > > > Date: Date
> > > > > > > Time: Time
> > > > > > > User: N/A
> > > > > > > Computer: ComputerName
> > > > > > > Description:
> > > > > > > A process serving application pool 'DefaultAppPool' suffered =
a fatal
> > > > > > > communication error with the World Wide Web Publishing Servic=
e The
> > > > > > > process id was '1234'. The data field contains the error numb=
er.
>
> > > > > > > Message 3
>
> > > > > > > Event Type: Warning
> > > > > > > Event Source: W3SVC
> > > > > > > Event Category: None
> > > > > > > Event ID: 1013
> > > > > > > Date: Date
> > > > > > > Time: Time
> > > > > > > User: N/A
> > > > > > > Computer: ComputerName
> > > > > > > Description:
> > > > > > > The process where application pool 'DefaultAppPool' was offer=
ed
> > > > > > > exceeded the time limitation in the middle of the shutdown. P=
rocess id
> > > > > > > was two '41 '
>
> > > > > > > At times, only any of the above entry is found in the event l=
og
> > > > > > > without the w3wp.exe exception dialog.
>
> > > > > > > We have run Microsoft's debug tool(Debug Diag) and have capt=
ured the
> > > > > > > following
>
> > > > > > > Analysis Summary
> > > > > > > Type Description Recommendation
> > > > > > > Error In
> > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d=
_Chance_Except­­­­­­=ADion_C0000005.dmp
> > > > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySList=
Fault in
> > > > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has =
caused an
> > > > > > > access violation exception (0xC0000005) when trying to read f=
rom
> > > > > > > memory location 0x00000002 on thread 8
>
> > > > > > > Heap corruption was detected in heap 0x00080000, however page=
heap was
> > > > > > > not enabled in this dump. Please follow the instructions in t=
he
> > > > > > > recommendation section for troubleshooting heap corruption is=
sues.
>
> > > > > > > Current NTGlobalFlags value: 0x0 An access violation exceptio=
n thrown
> > > > > > > by a heap memory manager function indicates heap corruption. =
Please
> > > > > > > follow the steps outlined in the following Knowledge Base art=
icle:
>
> > > > > > > 300966 Howto debug heap corruption issues in Internet Informa=
tion
> > > > > > > Services (IIS)
> > > > > > > Warning 1 client connection(s) in
> > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d=
_Chance_Except­­­­­­=ADion_C0000005.dmp
> > > > > > > have been executing a request for more than 90 seconds. Pleas=
e see the
> > > > > > > Client Connections section of this report for more detailed
> > > > > > > information about the connection(s).
>
> > > > > > > Analysis Details
> > > > > > > Table Of Contents
> > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d=
_Chance_Except­­­­­­=ADion_C0000005.dmp
>
> > > > > > > Top 5 threads by CPU time
>
> > > > > > > Thread report
>
> > > > > > > COM+ STA ThreadPool Report
>
> > > > > > > Well-Known COM STA Threads Report
>
> > > > > > > HTTP Report
>
> > > > > > > ASP Report
>
> > > > > > > Faulting Module Information
>
> > > > > > > Report for
> > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Secon d=
_Chance_Except­­­­­­=ADion_C0000005.dmp
> > > > > > > Type of Analysis Performed Combined Crash/Hang Analysis
> > > > > > > Machine Name INFCH02041
> > > > > > > Operating System Windows Server 2003 Service Pack 2
> > > > > > > Number Of Processors 2
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Dear Sir
We found out the reason for the memory exception. The
problem is we are generating a huge .html file at the server side. E.g
The size of the file will be 900 MB. When we are trying to load
the .HTML file from an .ASP file at the client side we are getting the
exception at the server side. We have solved this problem also. But we
are not able to find out the reason why the Exception has occurred. If
you have any idea regarding please let us know.

Thanks in advance

On Sep 21, 2:18 pm, David Wang wrote:
> Neither.
>
> The event log entry indicates that something inside the worker process
> prevented it from shutting down within its configured time limit when
> IIS told it to recycle due to some other recycling metric.
>
> The appropriate values are all depending on your server's
> configuration.
>
> I recommend running Application Verifier while you simulate using your
> application to try and find the memory problem.
>
> Of course, since there was no clear reproduction steps, you have no
> guarantee that what you are doing will actuall result in the memory
> issue you are looking for. So, you could be just wasting time. Or not.
> No one really knows. That's the unfortunate nature of bugs.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Sep 20, 9:26 pm, GaneshBabu...@gmail.com wrote:
>
>
>
> > Dear Sir
> > In order to simulate the memory problem we executed our
> > application for almost 48 hours continiously. We didnt get any memory
> >exceptionbut after 48 hours the session was cut and the following
> > message was logged in the event log
>
> > A process serving application pool DefaultAppPool exceeded time limits
> > during shut down. The process id was process id.
>
> > Event ID - 1013
>
> > Is it a problem or it is because our application ran for a long time
> > the process was shutdown.
>
> > On Sep 18, 12:55 pm, David Wang wrote:
>
> > > Following the strategy that I outline at:http://blogs.msdn.com/david.=
wang/archive/2005/08/29/HOWTO_Understand_...
>
> > > We are going after the issues one at a time, not all at once.
>
> > > We know there is memory corruption. I would use Application Verifier
> > > and enable "Page Heap" onw3wp.exe, and then try to reproduce the
> > > issue.
>
> > > When it happens, Application Verifier will break into the process. If
> > > you happen to have a debugger attached, you can directly observe the
> > > culprit.
>
> > > How to do this is beyond the scope of this newsgroup. You can either
> > > learn on your own, pay someone else to learn, or pay someone else to
> > > do it.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //
>
> > > On Sep 17, 11:52 pm,GaneshBabu...@gmail.com wrote:
>
> > > > Yes Sir our code is ASP, but we do use COM DLLs for Database
> > > > connectivity and Logging. When we analyzed the memory leaks we found
> > > > out that the BSTR were not freed using SysFreeString(). When we cal=
led
> > > > SysFreeString also the same problem persists. Sometimes we get an
> > > >exceptiondialog fromw3wp.exe, it is an memoryexception. I
> > > > downloaded Application verifier from micorosoft site but Iam not ab=
le
> > > > to executew3wp.exeusing the verifier. When Debug diag is not
> > > > runnning theexceptiondialog apperas and event log entries are
> > > > created, but if Debug diag is executed then theExceptiondialog does
> > > > not appear and only event log entries are created. Please help me in
> > > > how to use Appverifier forw3wp.exeservice and suggest me some method
> > > > through which i can identify the cause of the problem.
>
> > > > Thanks in Advance
>
> > > > On Sep 18, 1:23 am, David Wang wrote:
>
> > > > > It *could*, but I consider it the last option to explore because =
if it
> > > > > is a problem with IIS/Windows, the issue would be hit far more
> > > > > frequently and honestly we haven't seen such a deluge. I realize =
that
> > > > > users usually trust their own code and not Microsoft's, but histo=
ry
> > > > > has shown that to be an incorrect assumption. Put in another way =
-- if
> > > > > your application gets used by 100 million people in countless
> > > > > different ways, how likely do you think it'd have issues?
>
> > > > > ISAPI DLL is a common cause but not the only. Are you running *an=
y*
> > > > > third party code with your application. I see that your applicati=
on is
> > > > > ASP, so it is purely ASP which does not do *any* Server.CreateObj=
ect()
> > > > > or new ActiveXObject() calls? Those calls would load other native
> > > > > code into the web server that could crash, even if your web page =
is
> > > > > pure ASP.
>
> > > > > I'm also going to have to check if that "crash" is one of the exp=
ected
> > > > > exceptions -- there's a couple of internal Windows APIs that actu=
ally
> > > > > use exceptions as a normal part of operation and should be ignore=
d by
> > > > > the debugger. I could have sworn ntdll!
> > > > > ExpInterlockedPopEntrySListFault is one of them.
>
> > > > > Does this happen if you do not run DebugDiag to track memory leak=
s?
> > > > > Because you have a crash, not memory leak, and they are tracked
> > > > > differently
>
> > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > > > //
>
> > > > > On Sep 16, 9:52 pm,GaneshBabu...@gmail.com wrote:
>
> > > > > > Thanks for the help. But we dont use any ISAPI DLLs in our
> > > > > > application. We reviewed the code for memory leaks but didnt f=
ind any
> > > > > > problem. This problem is occurring only in windows 2003 R2 SP2.=
Will
> > > > > > it be a problem with 2003 R2?
>
> > > > > > On Sep 16, 12:14 pm, David Wang wrote:
>
> > > > > > > Your application is running native code which is crashing the=
worker
> > > > > > > process (that's what 0xc0000005 means).
>
> > > > > > > There is also signs of memory corruption in the worker proces=
s It
> > > > > > > *may* be the cause of the crash (in which case you have one i=
ssue), or
> > > > > > > it may not (which means you have more than one issue within y=
our
> > > > > > > website).
>
> > > > > > > Please start by identifying all custom ISAPI Filter DLL and I=
SAPI
> > > > > > > Extension DLL loaded on your server.
>
> > > > > > > When there is signs of memory corruption, the code that actua=
lly
> > > > > > > crashed may *not* be the culprit but rather unfortunate victi=
m of the
> > > > > > > memory corrupting code. For example, the code that crashed in=
your
> > > > > > > example was NTDLL, an internal Windows DLL, but what it was d=
oing is
> > > > > > > hardly the cause of the memory corruption -- it is clearly th=
e victim
> > > > > > > of some other memory corrupting code. It is usually beneficia=
l to
> > > > > > > enable PageHeap to catch many (but not all) code that corrupt=
memory
> > > > > > > as it corrupts its, which is like catching a crook red-handed.
>
> > > > > > > Microsoft publishes free Application Verifier as well as Debu=
gging
> > > > > > > Tools which do all these things (and more), as well as general
> > > > > > > instructions on how to use them. It would be beneficial in yo=
ur
> > > > > > > situation to use them to diagnose your issue.
>
> > > > > > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. W=
ang
> > > > > > > //
>
> > > > > > > On Sep 14, 5:02 am,GaneshBabu...@gmail.com wrote:
>
> > > > > > > > Hi,
>
> > > > > > > > We are running ASP application in IIS 6.0.
> > > > > > > > Butw3wp.execrashes unexpectedly with the following message.
>
> > > > > > > > Anexceptiondialog appears and one of the following message =
is logged
> > > > > > > > in event log
>
> > > > > > > > And any one of the following are logged in the System log d=
uring the
> > > > > > > >w3wp.exeexception:
> > > > > > > > Message 1
>
> > > > > > > > Event Type: Warning
> > > > > > > > Event Source: W3SVC
> > > > > > > > Event Category: None
> > > > > > > > Event ID: 1009
> > > > > > > > Date: Date
> > > > > > > > Time: Time
> > > > > > > > User: N/A
> > > > > > > > Computer: ComputerName
> > > > > > > > Description:
> > > > > > > > A process serving application pool 'DefaultAppPool' termina=
ted
> > > > > > > > unexpectedly. The process id was '1234'. The process exit c=
ode was
> > > > > > > > '0xc0000005'.
>
> > > > > > > > Message 2
>
> > > > > > > > Event Type: Warning
> > > > > > > > Event Source: W3SVC
> > > > > > > > Event Category: None
> > > > > > > > Event ID: 1011
> > > > > > > > Date: Date
> > > > > > > > Time: Time
> > > > > > > > User: N/A
> > > > > > > > Computer: ComputerName
> > > > > > > > Description:
> > > > > > > > A process serving application pool 'DefaultAppPool' suffere=
d a fatal
> > > > > > > > communication error with the World Wide Web Publishing Serv=
ice. The
> > > > > > > > process id was '1234'. The data field contains the error nu=
mber.
>
> > > > > > > > Message 3
>
> > > > > > > > Event Type: Warning
> > > > > > > > Event Source: W3SVC
> > > > > > > > Event Category: None
> > > > > > > > Event ID: 1013
> > > > > > > > Date: Date
> > > > > > > > Time: Time
> > > > > > > > User: N/A
> > > > > > > > Computer: ComputerName
> > > > > > > > Description:
> > > > > > > > The process where application pool 'DefaultAppPool' was off=
ered
> > > > > > > > exceeded the time limitation in the middle of the shutdown.=
Process id
> > > > > > > > was two '41 '
>
> > > > > > > > At times, only any of the above entry is found in the event=
log
> > > > > > > > without thew3wp.exeexceptiondialog.
>
> > > > > > > > We have run Microsoft's debug tool(Debug Diag) and have ca=
ptured the
> > > > > > > > following
>
> > > > > > > > Analysis Summary
> > > > > > > > Type Description Recommendation
> > > > > > > > Error In
> > > > > > > > w3wp__PID__4468__Date__09_11_2007__Time_10_30_53AM__0__Seco=
nd_Chance_Except­­­­­­­­ion_C0000005.dmp
> > > > > > > > the assembly instruction at ntdll!ExpInterlockedPopEntrySLi=
stFault in
> > > > > > > > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation ha=
s caused an
> > > > > > > > access violationexception(0xC0000005) when trying to read f=
rom
> > > > > > > > memory location 0x00000002 on thread 8
>
> > > > > > > > Heap corruption was detected in heap 0x00080000, however pa=
geheap was
> > > > > > > > not enabled in this dump. Please follow the instructions in=
the
> > > > > > > > recommendation section for troubleshooting heap corruption =
issues.
>
> > > > > > > > Current NTGlobalFlags value: 0x0 An access violationexcepti=
onthrown
> > > > > > > > by a heap memory manager function indicates heap corruption=
.. Please
> > > > > > > > follow the steps outlined in the following Knowledge Base a=
rticle:
>
> > > > > > > > 300966 Howto debug heap corruption issues in Internet Infor=
mation
> > > > > > > > Services (IIS)
> > > > > > > > Warning 1 client connection(s) in
>
> ...
>
> read more =BB- Hide quoted text -
>
> - Show quoted text -

Re: w3wp.exe exception

Dear Sir
The actual problem was the we write the entire contents of
the .HTML file within a